How does the OpenID Connect authorization code flow run, step by step?

(0) RP prepares the request, (1) redirect and authentication request to the auth endpoint, (2) OP authenticates the user and gets consent, (3) redirect with the code back to the RP, (4) code exchanged at the token endpoint for access, refresh and ID token, (5) RP validates the ID token, (6) optionally fetches claims from UserInfo.

* The browser carries the request and the code; tokens and claims travel directly between the RP and the OP. *

0. Prepare: a user wants a resource at client.example.org; the RP has no session for them and builds an authorization request.
1. a) Redirect: the RP answers with 302 Found to https://server.example.com/authorize?response_type=code&scope=openid%20profile%20email&client_id=...&state=...&redirect_uri=.... b) Authentication request: the browser follows it to the OP's authorization endpoint. c) The OP must validate the request.
2. a) Authenticate: the OP authenticates the user. b) Consent: the OP obtains the user's authorisation.
3. a) Redirect with code: the OP sends the browser back to https://client.example.org/cb?code=...&state=... (or error=... on failure). b) The RP must validate the response, including state.
4. a) Token request (back channel, TLS mandatory): the RP POSTs grant_type=authorization_code, the code and the redirect URI to the token endpoint, authenticating with its client ID and secret. b) Token response: the OP validates the request and returns access_token, token_type: Bearer, refresh_token, expires_in and id_token.
5. Validate: the RP validates the ID token and access token and reads the user's subject identifier (sub).
6. a) (Optional) UserInfo request with the access token over TLS. b) The OP returns the user's claims.

Go deeper:

• OpenID Connect Core 1.0: Authentication using the Authorization Code Flow — the normative steps with the same example messages.
• OpenID Connect Playground — run the flow against a real provider and inspect each request, code and token.
• OktaDev: An Illustrated Guide to OAuth and OpenID Connect — a short animated walk through the flow.