Glossary: Identity and Access Management

authorization code flow

Also written: code flow

The OAuth flow almost every app should use. The browser carries a one-time code back to the app, and the app swaps it for tokens directly with the server, so tokens never pass through the browser. It should always be protected with state and PKCE.