Quiz Entry - updated: 2026.10.22
Which codes and tokens are used in OAuth 2.0 and OpenID Connect, what does each contain, and how is it transferred?
Authorization code (front channel, short-lived, single use), access token (back channel to the client, then in API requests), refresh token (back channel, only to the token endpoint) and ID token (OIDC only, back channel in the code flow, a signed JWT about the authentication).
| Artefact | Content | Lifetime | Transfer | Protocol |
|---|---|---|---|---|
| Authorization code | A random string generated by the authorization server; bound to client ID and redirect URI | About 10 min, single use | Front channel: redirect URL through the browser | OAuth and OIDC (code flow) |
| Access token | Scope, lifetime and other access attributes (opaque or a JWT) | Minutes to hours | Back channel from the token endpoint; then Authorization: Bearer header to APIs |
OAuth and OIDC |
| Refresh token | Authorisation to obtain new access tokens for a user | Days to years, revocable | Back channel, only between client and token endpoint | OAuth and OIDC |
| ID token | Signed JWT: who the user is, who issued it, for which client, when and how they authenticated | Short (minutes) | Back channel in the code flow; in the redirect in implicit and hybrid flows | OIDC only |
Pattern to remember: everything that grants access (access, refresh token) or proves identity (ID token) arrives over the back channel in the recommended code flow; only the code, which is worthless without the client's credentials and PKCE verifier, uses the front channel.
Go deeper:
OpenID Connect Core 1.0: Token Endpoint — the token response with all three tokens.- oauth.net: Bearer Tokens — how access tokens are presented to APIs.