OAuth 2.0 Flows Demystified: Authorization Code, PKCE, and Client Credentials

OAuth 2.0 Is Not Authentication OAuth 2.0 is an authorization framework. It answers: "Can application X access resource Y on behalf of user Z?" OpenID Connect (OIDC) layers authentication on top: "Who is this user?" Most developers use both without realizing it. The Four Flows 1. Authorization Code Flow (Web Apps) The standard flow for web applications with a backend. Browser → Your App → GitHub/Google ("Allow access?") → Your App (with code) → Exchange code for token // Step 1: Redirect user to provider app.get('/auth/github', (req, res) => { const state = generateRandomString(16); // CSRF protection req.session.oauthState = state; const params = new URLSearchParams({ client_id: process.env.GITHUB_CLIENT_ID!, redirect_uri: `${process.env.APP_URL}/auth/github/callback`, scope: 'read:user user:email', state, }); res.redirect(`https://github.com/login/oauth/authorize?${params}`); }); // Step 2: Handle callback with code app.get('/auth/github/callback', async (req, res) => { const {