OAuth 2.0 - Authorization Code flow

A short video describing how the OAuth 2.0 Authorization Code flow works. Find more info on oauth at my blog:
Please check my web site instead:

In addition, checkout my open source project that implements an OpenID Connect proxy server:

P.S.: thanks for the great comments!

If this video was helpful to you, please consider buying me a coffee:

[Kili-mo-money]

Awesome video! Thank you for sharing your knowledge 🙏

[FrequencyModulator]

Thank you! Finally understood why do we need the authorization code!

[susmitdey]

Very well explained, simplified the concept, thanks Sascha.

[Jiji-lozs]

Very well detailed and clear. I now understood the flow. You are appreciated.

[joshli]

Simple, concise and very very effective. Thanks a million!

[expertreviews]

What an amazing, well explained video... God bless you my friend!!! More power to you... Liking and subscribing right now...

[kalyankumar]

I have been struggling to understand OAuth flow + parameters + Request Type in each comm.. This video clears all my doubts.. Great.. Pls share similar for PKCE SPA App

[Matheuzrp]

thank your very much sir, great explanation !!

[ScorpionKZ]

Excellent and concise explanation. Thanks!

[abhishekchavan]

Simple plain and a good explanation!!! thanks a lot you saved me a lot of time!

[priyankachougule]

Yes really helped! Thanks for comprehensive explanation!

[kacy]

Smooth explanation. You’re an absolute gangster.

[SubtleAsh-TheImmortal]

Good explanation. But for better detail, you could mention that the auth code + clientID+ client Secret happens between app server side to Google. Otherwise, it gives an impression to the viewer that client ID and client Secret stay on the client-side.

[jameseze]

What I haven't understood is: why the authorization code?, why not send client_id+ secrete to Google then get back a token?. What's the essence of the middle step?

[DMoots]

I've a few questions about this
1. How does the first part of the flow change when a user is returning to the site and the client already has a valid auth token.
2. If the token is stored on the client, how does the client know which user that token relates to?
3. If the auth server and the resource server are separate, how do they each know that a token is valid? (session? )

[olegsuprun]

nice explanation, could you tell what is the difference between auth code flow and implicit flow?

[Dogezi]

Hello Sascha. These videos are really useful to understand the flows. Just two questions...
1. In this flow, does the access token gets stored in the browser and the browser makes the requests to google? (in this example let's say with JS) or does the web server is the one that must make always the requests?
2. Also, where do you store the refresh token? Is it something that you can store in the browser side or do I need to have a database with a refresh_token <-> user relation? I don't get at all this last part of where to store the refresh token.

Thanks :D

[vikash]

Can all this be achieved just via APIs and no UI interaction like where the user clicks "Allow"..

[amolgangurde]

Thank you. All have saw your entire oauth and openid series video, all are awesome, could you please covered security in oauth and openid in your upcoming video.. P.S could you please share your presentation slidedesk.just for reference

[deepakchanalia]

Thanks Sascha, Though it helped me to understand the AZ_Code flow but I am bit confused about the SSO part using authorization_code. How can two different client applications can use authorization_code flow to participate in SSO. Will the same procedure applies to any number of clients for successful SSO ?