How does the OAuth authorization code flow work, step by step?

The user agent gets an authorization code via the front channel after the user authenticates; the client then exchanges that code, together with its own credentials, for an access token (and optionally a refresh token) via the back channel.

* Only the short-lived code passes through the browser; the tokens travel directly from the authorization server to the client. *

1. Initial request (front channel): the client redirects the user agent (browser) to the authorization server with its client ID, the requested scope, a local state value and the redirect URI.
2. User authenticates (front channel): the resource owner logs in at the authorization server and consents.
3. Response with authorization code (front channel): the authorization server redirects the user agent back to the redirect URI with the authorization code and the unchanged state.
4. Request for access token (back channel): the client sends the code, its client authentication and the redirect URI directly to the authorization server's token endpoint (grant_type=authorization_code).
5. Response with access token (back channel): the server returns the access token and optionally a refresh token.

Front channel means the message travels through the browser (as a redirect URL that the user, browser extensions and history can see). Back channel means a direct, TLS-protected server-to-server HTTP request that the browser never touches.

Go deeper:

• RFC 6749, Section 4.1: Authorization Code Grant — the exact request and response parameters for each step.
• oauth.net: Authorization Code Grant — a short overview with links to the related extensions.
• OAuth 2.0 Playground (oauth.com) — walk through the authorization code flow and PKCE interactively against a real server.