Reading — step 1 of 5
Read
~1 min readOAuth Concepts
Grant Types
OAuth 2.0 has multiple "flows" (grant types) for different scenarios:
| Grant | Use case | Status |
|---|---|---|
| Authorization Code | Web apps with backend (server-to-server token exchange) | Recommended |
| Auth Code + PKCE | Mobile apps, SPAs (no client secret) | Recommended |
| Client Credentials | Server-to-server, no user involved | OK |
| Resource Owner Password | User gives password to app (anti-pattern) | DEPRECATED |
| Implicit | Old SPA pattern; tokens in URL fragment | DEPRECATED (use PKCE) |
| Device Code | TVs, CLI tools without browsers | OK |
| Refresh Token | Renew access without re-prompting user | Used WITH others |
Authorization Code + PKCE is the modern default for almost everything. Removed:
- Implicit flow: tokens leaked through browser history.
- Password grant: defeats OAuth's purpose (apps see passwords).
Don't implement deprecated flows. Modern OAuth providers refuse to issue tokens via password/implicit grants.
OAuth 2.1 (in progress) consolidates this — it's basically "OAuth 2 minus the deprecated bits".
Discussion
Ask a question, share an insight, or help someone who’s stuck.
Sign in to post a comment or reply.
Loading…