AuthCode

AuthCode, short for authorization code, is a credential used in OAuth 2.0 and OpenID Connect flows. It is issued by the authorization server to the client after the resource owner authenticates and consents. The code is a temporary, one-time value that the client can exchange for an access token, and optionally a refresh token, via a server-to-server request.

In typical operation, the client directs the user-agent to the authorization endpoint with parameters such as response_type=code, client_id, redirect_uri, scope, and state. After the user authenticates and approves access, the authorization server redirects the user-agent back to the client with an authorization code. The client then makes a back-channel request to the token endpoint, presenting the code and authenticating (using a client secret for confidential clients, or PKCE for public clients). The authorization server validates the code and responds with tokens.

Security properties are integral to the design. The code is intended for single use and has a short lifetime. It should be transmitted and stored securely over HTTPS, and avoid exposure in user agents beyond the redirect. PKCE (Proof Key for Code Exchange) enhances security for public clients by binding the code to a code verifier. The use of a state parameter helps mitigate cross-site request forgery.

AuthCode flows are widely used for server-side applications and other capable clients. OpenID Connect commonly uses the authorization code flow to return an ID token along with access tokens, providing authentication alongside authorization. This approach is generally preferred over implicit flows due to stronger security guarantees.