OAuth2

Grant Types

• Authorization Code + PKCE
• Client Credentials
• Delegation
• Implicit

“The Implicit flow was a simplified OAuth flow previously recommended for native apps and JavaScript apps where the access token was returned immediately without an extra authorization code exchange step.” - https://oauth.net/2/grant-types/implicit/

• Password Credentials

“The Password grant type is a way to exchange a user’s credentials for an access token. Because the client application has to collect the user’s password and send it to the authorization server, it is not recommended that this grant be used at all anymore.” - https://oauth.net/2/grant-types/password/

References

• https://www.oauth.com/oauth2-servers/background/
• https://aaronparecki.com/oauth-2-simplified/
• https://example-app.com/pkce
• https://www.youtube.com/watch?v=CPbvxxslDTU
• https://auth0.com/docs/authorization/which-oauth-2-0-flow-should-i-use
• https://www.oauth.com/playground/index.html
• https://auth0.com/blog/is-building-identity-really-that-hard-a-closer-look/