The OAuth2 Authorization Code grant is the standard flow for server-side web applications, where the user authenticates directly with the provider and the application only ever handles a short-lived authorization code, never the user's credentials.
Key Points: • The user is redirected to the authorization server's login/consent page, keeping credentials off the client entirely. • On approval, the browser is redirected back to the client with a one-time authorization code in the URL. • The client's backend exchanges that code for an access token via a confidential, server-to-server call using its client secret. • Because the token exchange happens server-side, the access token never passes through the user's browser, reducing exposure. • This grant is recommended for traditional web apps; SPAs typically pair it with PKCE for additional protection.
Example: Logging into a website with "Sign in with GitHub" redirects you to GitHub, and after you approve access, GitHub sends the site a code that its backend server exchanges for a token—your GitHub password is never seen by the site.
Interview Tip: A concise interview answer is:
"The Authorization Code grant sends the user to the provider's login page, and after consent the provider returns a one-time code to the client. The client's backend then exchanges that code, along with its client secret, for an access token in a secure server-to-server call, so the token and credentials never transit the user's browser directly."