Authorization Code

Overview

It's a grant type used when the client wants to request access to protected resources on behalf of another user (i.e. a 3rd party). This is the grant type most often associated with OAuth.

This grant type is used to obtain both access tokens and refresh tokens and is optimized for confidential clients. Since this is a redirection-based flow, the client must be capable of interacting with the resource owner's user agent and also capable of receiving incoming requests from the authorization server.

## Use Cases

• Calls on behalf of a third party.