Authorization Code Flow

The standard for web apps:

1. User clicks "Login with Google" in your app.
2. Your app redirects to:
     https://accounts.google.com/o/oauth2/v2/auth
       ?client_id=YOUR_CLIENT_ID
       &redirect_uri=https://yourapp.com/callback
       &response_type=code
       &scope=openid email
       &state=RANDOM_NONCE
3. Google authenticates the user (login form, MFA, etc.)
4. User clicks "Allow"
5. Google redirects back: https://yourapp.com/callback?code=XYZ&state=RANDOM_NONCE
6. Your BACKEND exchanges code for token:
     POST https://oauth2.googleapis.com/token
       grant_type=authorization_code
       code=XYZ
       client_id=YOUR_CLIENT_ID
       client_secret=YOUR_CLIENT_SECRET
       redirect_uri=https://yourapp.com/callback
7. Google returns: { access_token, refresh_token, expires_in, ... }

The CODE is short-lived (~1 minute) and single-use. The token exchange happens server-to-server (so the client_secret never touches the browser).

state parameter: random nonce, sent and echoed. Defends against CSRF — your backend verifies the state matches what it issued.

scope: which permissions you're requesting. Server displays them on the consent screen.

This is the most secure flow because the secret stays on the server. Browser never sees the token issued via redirect.