Which four authorization grant types does OAuth 2.0 define, and when is each one used?
Authorization code (server-side apps; with PKCE also for apps on the user's device), implicit (former browser and mobile flow, now replaced by code + PKCE), resource owner password credentials (only highly trusted, first-party apps) and client credentials (machine-to-machine, no user involved).
* Today's choice is short: a user involved means authorization code with PKCE, no user means client credentials. *
| Grant | grant_type |
Typical client | Status |
|---|---|---|---|
| Authorization code | authorization_code |
Server-side web apps; with PKCE also SPAs and mobile apps | The default |
| Implicit | (none: token comes straight from the authorization endpoint) | Browser apps and mobile apps that run on the user's device | Not recommended any more; replaced by authorization code + PKCE |
| Resource owner password credentials | password |
Trusted apps, e.g. ones owned by the service itself | Discouraged; removed in OAuth 2.1 |
| Client credentials | client_credentials |
API access by applications, inter-service communication | Current; only the client is authenticated, no resource owner involved |
The grant type is the method by which the application obtains authorisation, and each one results in a different message sequence. More generally there are further extension grants, such as the device authorization grant (RFC 8628) for input-constrained devices like smart TVs, where the user approves on a second device.
Go deeper:
oauth.net: OAuth Grant Types — every grant type with its current status and a link to its details.- RFC 6749, Section 1.3: Authorization Grant — the four original grant types as specified.