Implicitgrant

The Implicit Grant is an OAuth 2.0 flow designed for client-side applications, such as single-page applications (SPAs) running in a web browser, or native mobile applications. In this flow, after a user authenticates with the authorization server, the authorization server redirects the user's browser back to the client application with an access token directly embedded in the URL fragment. This means the access token is delivered via the browser's address bar. The client application then extracts the access token from the URL fragment.

The Implicit Grant is considered less secure than other OAuth 2.0 flows, particularly the Authorization Code Grant with PKCE, due to the direct exposure of the access token in the browser's URL. This makes it vulnerable to interception, especially on shared or compromised devices. Consequently, the Implicit Grant is generally not recommended for new applications. It was primarily intended for scenarios where client-side applications could not securely store a client secret, which is a requirement for the Authorization Code Grant without PKCE. Modern best practices and security recommendations favor flows that do not expose access tokens directly in the URL.