OAuth 2.0 flows

  • Authorization Code + PKCE — for user-facing apps (web, mobile). The code is exchanged for tokens server-side or with PKCE for SPAs. Always use this.
  • Client Credentials — for machine-to-machine. No user involved. Service authenticates with client_id + client_secret.
  • Implicit flow — deprecated. Do not use.

Authorization Code + PKCE flow

  1. App generates a code_verifier (random string) and code_challenge (SHA-256 hash of verifier).
  2. Redirect user to IdP with code_challenge.
  3. User authenticates; IdP redirects back with authorization code.
  4. App exchanges code + code_verifier for access token and ID token.

Scopes

Request only the scopes you need. openid profile email for login. Specific resource scopes (orders:read, payments:write) for API access. Never request all scopes speculatively.

Identity providers

Auth0, Okta, AWS Cognito, and Keycloak (self-hosted) all implement OAuth 2.0 + OIDC. Do not implement OAuth from scratch — use a vetted library and a managed IdP.