Authorization code flow in Rest API - Step-by-Step Execution

Concept Flow - Authorization code flow

User requests login

↓

Redirect to Authorization Server

↓

User logs in and consents

↓

Authorization Server sends code

↓

Client sends code + client secret to Token Endpoint

↓

Token Endpoint validates and returns Access Token

↓

Client uses Access Token to access resource

This flow shows how a client app gets an authorization code, exchanges it for an access token, and then accesses protected resources.

Execution Sample

Rest API

1. User -> Client: Request login
2. Client -> Auth Server: Redirect with client_id
3. Auth Server -> User: Login & consent
4. Auth Server -> Client: Authorization code
5. Client -> Auth Server: Code + client_secret
6. Auth Server -> Client: Access token
7. Client -> Resource Server: Access token

Step-by-step message exchange in the authorization code flow.

Execution Table

Step	Actor	Action	Data Sent	Response/Result
1	User -> Client	User requests login	Login request	Client prepares redirect
2	Client -> Auth Server	Redirect user to auth server	client_id, redirect_uri, scope	Auth server shows login page
3	User -> Auth Server	User logs in and consents	User credentials, consent	Auth server validates user
4	Auth Server -> Client	Send authorization code	Authorization code	Client receives code
5	Client -> Auth Server	Exchange code for token	Authorization code, client_secret	Auth server validates and returns access token
6	Auth Server -> Client	Return access token	Access token	Client stores token
7	Client -> Resource Server	Access resource	Access token	Resource server returns data
8	-	End	-	Flow complete

💡 Flow ends after client uses access token to access resource successfully.

Variable Tracker

Variable	Start	After Step 4	After Step 6	Final
authorization_code	None	Received from auth server	Used and invalidated	None (used)
access_token	None	None	Received from auth server	Stored for resource access
user_logged_in	False	True	True	True

Key Moments - 3 Insights

Why does the client send the authorization code along with the client secret to the token endpoint?

Because the client secret proves the client is authorized to exchange the code for a token, preventing misuse. See execution_table step 5.

Why can't the client use the authorization code directly to access resources?

The authorization code is just a temporary code to get the access token. Only the access token can be used to access resources. See execution_table steps 4 and 7.

What happens if the user does not consent during login?

The authorization server will not issue an authorization code, so the flow stops early. This is implied before step 4 in the execution_table.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does the client receive the authorization code?

A Step 5

B Step 4

C Step 6

D Step 7

💡 Hint

Check the 'Data Sent' and 'Response/Result' columns at step 4.

According to variable_tracker, what is the state of 'access_token' after step 4?

A Received from auth server

B Stored for resource access

C None

D Used and invalidated

💡 Hint

Look at the 'access_token' row under 'After Step 4' column.

If the client secret is missing when exchanging the code, what would happen in the flow?

A Token endpoint rejects the request

B Access token is still issued

C Authorization code is sent again

D User is asked to login again

💡 Hint

Refer to key_moments about client secret importance and execution_table step 5.

Concept Snapshot

Authorization Code Flow:
1. User logs in via client redirect.
2. Auth server sends code to client.
3. Client exchanges code + secret for access token.
4. Client uses token to access resources.
Key: Code is short-lived, secret proves client identity.

Full Transcript

The Authorization Code Flow is a way for a client app to get permission to access user data securely. First, the user asks to log in. The client sends the user to the authorization server with its ID. The user logs in and agrees to share data. The server sends a temporary code back to the client. The client then sends this code along with its secret to the server's token endpoint. If valid, the server returns an access token. The client uses this token to get data from the resource server. This flow protects user data by requiring the client secret and exchanging a short-lived code for a token.

Practice

1. What is the main purpose of the authorization code in the Authorization Code Flow?

easy

A. To exchange it for an access token securely

B. To directly access user data

C. To authenticate the user with a password

D. To refresh the access token automatically

Solution

1. Step 1: Understand the role of the authorization code

   The authorization code is a temporary code given after user consent, not the token itself.

2. Step 2: Identify what the app does with the code

   The app sends this code to the authorization server to get an access token securely.

3. Final Answer:

   To exchange it for an access token securely -> Option A

4. Quick Check:

   Authorization code = temporary code for token exchange [OK]

Hint: Authorization code is a temporary code, not a token [OK]

Common Mistakes:

• Thinking the code directly accesses data
• Confusing code with user password
• Assuming code refreshes tokens

2. Which HTTP method is typically used by the app to exchange the authorization code for an access token?

easy

A. DELETE

B. GET

C. PUT

D. POST

Solution

1. Step 1: Recall the token exchange request

   The app sends the authorization code to the token endpoint to get an access token.

2. Step 2: Identify the HTTP method used

   This request uses POST because it sends data securely in the request body.

3. Final Answer:

   POST -> Option D

4. Quick Check:

   Token exchange uses POST method [OK]

Hint: Token exchange sends data securely, so use POST [OK]

Common Mistakes:

• Using GET which exposes data in URL
• Confusing PUT or DELETE with token exchange
• Assuming token exchange is a simple GET request

3. Given this simplified token exchange request in Python:

import requests
response = requests.post('https://auth.example.com/token', data={
    'code': 'abc123',
    'client_id': 'myapp',
    'client_secret': 'secret',
    'redirect_uri': 'https://myapp.com/callback',
    'grant_type': 'authorization_code'
})
print(response.json().get('access_token'))

What will this code print if the exchange is successful?

medium

A. The authorization code 'abc123'

B. The access token string from the server

C. An error message about invalid client

D. None

Solution

1. Step 1: Understand the request purpose

   The code sends a POST request to exchange the authorization code for an access token.

2. Step 2: Analyze the printed output

   If successful, the server returns JSON with an 'access_token' key, which is printed.

3. Final Answer:

   The access token string from the server -> Option B

4. Quick Check:

   response.json()['access_token'] = access token [OK]

Hint: Successful exchange returns access token, not code [OK]

Common Mistakes:

• Printing the code instead of token
• Expecting error message on success
• Not accessing JSON correctly

4. In the Authorization Code Flow, a developer wrote this code snippet to exchange the code:

response = requests.get('https://auth.example.com/token', params={
    'code': 'abc123',
    'client_id': 'myapp',
    'client_secret': 'secret',
    'redirect_uri': 'https://myapp.com/callback',
    'grant_type': 'authorization_code'
})

What is the main issue with this code?

medium

A. Incorrect redirect URI format

B. Missing the authorization code parameter

C. Using GET instead of POST for token exchange

D. Client secret should not be sent

Solution

1. Step 1: Check HTTP method for token exchange

   The token exchange requires a POST request to send sensitive data securely.

2. Step 2: Identify the problem in the code

   The code uses GET with query parameters, which is insecure and not standard for this flow.

3. Final Answer:

   Using GET instead of POST for token exchange -> Option C

4. Quick Check:

   Token exchange must use POST, not GET [OK]

Hint: Token exchange always uses POST, not GET [OK]

Common Mistakes:

• Using GET exposes secrets in URL
• Forgetting to send client secret
• Assuming redirect URI format is wrong

5. A web app uses Authorization Code Flow with PKCE (Proof Key for Code Exchange). Which additional step does PKCE add to improve security?

hard

A. The app sends a code verifier with the token request to prove it initiated the flow

B. The app uses client secret only without authorization code

C. The user enters their password twice during login

D. The app skips the authorization code and uses implicit flow

Solution

1. Step 1: Understand PKCE purpose

   PKCE adds a code verifier and challenge to prevent interception of the authorization code.

2. Step 2: Identify the added step in the flow

   The app sends the code verifier with the token request to prove it started the flow and prevent attacks.

3. Final Answer:

   The app sends a code verifier with the token request to prove it initiated the flow -> Option A

4. Quick Check:

   PKCE adds code verifier step for security [OK]

Hint: PKCE adds code verifier to token request for security [OK]

Common Mistakes:

• Thinking PKCE removes authorization code
• Confusing PKCE with password prompts
• Assuming PKCE uses implicit flow