OAuth Authorization code flow

00:00 What is the OAuth authorization code flow?
02:54 OAuth authorization code example walkthrough
06:16 exchanging authorization code for an access token
08:38 OAuth CSRF protection with state parameter and PKCE
10:16 OAuth authorization code grant for server side rendered apps
11:15 conclusion

The authorization code flow is a way with which a client ( a third party application) can obtain an access token that provides it limited access to an HTTP service on behalf of a user.

The client initiates the authorization code flow by redirecting the user to the authorization server with client id, state, scopes and a redirect URl as query parameters. There, the user is asked to log into his account and confirm that he wants the third party application to access his account on his behalf. Once approved, the person gets redirected back to the client application with an authorization code in the query parameters. The application can then go and exchange this authorization code for an access token.

If the client is a confidential client, then a client secret is also needed to exchange the authorization code for an access token. Depending on the scopes that the client requested it may also receive a refresh token which allows it get fresh access token in case the current access token has expired.

[jgoebel]

What do you think about this?
Please let me know in the comments below.

[prakashsundra]

The details were superb.. you clearly explained the flow. Great job ProductionCoder!

[chrislaneyphotography]

Greatly appreciate this. Explanation of this flow brought it home for me on understanding

[shanerigsby]

Your approach to explaining this is excellent. Thank you!

[vineetchaurasia]

One of the greatest content on oauth i ever found on YouTube,
Thanks bud, for this wonderful content

[andrebittencourt]

This video was incredible!! Thank you for share so much knowledge!

[umairyetoo]

Man, I am a backend dev with 4 yrs of exp. but believe me man I always get lost in this Oauth Grants. I always need to re do all R&D again. But here you explained very well mate, I must say perfectly explained. Kepp it up

[madrag]

Finally explanation I was looking for, thanks!

[VitalikAwesome]

I came here to put like! Everything clear I have no questions Thanks for video

[Neunelfer]

Very understandable, thanks for your efforts!

[boomboom-]

Great video, thanks for explaining that way!

[feysalmama]

Amazing explanation!. Thank you for your effort.

[m.k.bearit]

thanks! well prepared and informative, made my life much easier :)

[rodinCodin]

awesome explanation, thank you, you've got another subscriber!

[MAxAMILLIoN]

Can you share a read-only link to that drawio doc? Would be very helpful.

[JedGrant]

Great video. Would love to watch a follow up with a react app creating or updating a Google Doc.

[supa]

best explanation on youtube, thank you!

[mdamirhossain]

So far, its seems excellent tutorial to me. I bet, these video should have more like and subs...

[muralikumara]

The details are well explained, thank you. Would be helpful if you share the diagram which is referenced in this tutorial.

[entropy]

Hey, I really love this video especially because it show visually whats going on instead of just tossing jargon around. What wasnt entirely clear though is WHY the code / token exchange is happening. Like, I dont understand how that extra steps adds additional security compared to the implicit flow for example. Any chance you could give me a hint here?