Prerequisites
What it is
The OAuth2 authorization code flow lets an application redirect a user to an identity provider, receive a short-lived code, and exchange it for tokens.
Why it matters
It allows delegated access and social login without sharing passwords with third-party applications.
How it works
The app redirects the user to the provider with client ID, redirect URI, scopes, state, and usually PKCE. After consent, the provider redirects back with a code. The app exchanges the code for tokens server-side.
The code is short-lived and exchanged server-side, so the access token never passes through the browser. PKCE adds a code challenge so even public clients (mobile apps, SPAs) are protected against code interception.
When to use it
Use it for web apps, mobile apps with PKCE, social login, SaaS integrations, and delegated API access.
Tradeoffs / failure modes
Redirect URI validation, state verification, token storage, scope design, and account linking must be handled carefully.
Tiny example
A user clicks “Sign in with GitHub”, approves access on GitHub, and your app exchanges the returned code for an access token.
Related guides and systems
See OAuth2 & Social Login, RBAC, GitHub, Gmail, and Google Drive.
Seen in deeper dives
Capability
OAuth2 & Social Login
Authorization code flow, token refresh, and provider federation for third-party authentication
Capability
Role-Based Access Control
Permission models, policy engines, and row-level security for multi-user applications
Case Study
GitHub
The world's largest code hosting platform powered by Git at scale
Case Study
Gmail
The world's largest email service with AI-powered organization and search
Case Study
Google Drive
Cloud file storage and real-time collaboration at planetary scale