There are five types of grant in the OAuth2:
Authorization Code Grant: For example, consider an end-user (resource owner) granting a print service (client) access to the user’s protected photos stored at a photo-sharing service (resource server). In this type of grant,
1.) The client will redirect the user to the authorization server with the client id, scope and redirect URI.
2.) The authorization server will validate all these parameters.
3.) The user will then be asked to login to the authorization server and approve the client. If the user approves the client they will be redirected from the authorization server back to the client (specifically to the redirect URI) with authorization code.
4.) The client will now send a POST request to the authorization server with the grant type (type: authorization_code), authorization code, client id, client secret and redirect uri.
5.) Then authorization server will return JSON object with access token, expiry time and refresh token (used when access token expires).3 …show more content…
It is intended to be used for user-agent-based clients (e.g. single page web apps) that can’t keep a client secret because all of the application code and storage is easily accessible. Secondly instead of the authorization server returning an authorization code which is exchanged for an access token, the authorization server returns an access token. This grant is intended to be used for user-agent-based clients (e.g. single page web apps) that can’t keep a client secret because all of the application code and storage is easily accessible. This grant does not return a refresh token because the browser has no means of keeping it private. In this type of