Authorization code vs token

Description > Authorization code vs token

Click on link to DOWNLOAD: ※ Authorization code vs token - Link

There we saw examples of the and the in practice. According to Nate Barbettini we want the extra step of exchanging the authentication code for the access token, because the authentication code can be used in the front channel less secure , and the access token can be used in the back channel more secure.

Must not be specified with other values. Expiration of access tokens is optional. There is an overlap in the supported scenarios between this grant and the Authorization Code Grant — we will look more at that below.

OpenID Connect explained - The token is a reference i. If the client was issued a client secret, then the server must authenticate the client.