OAuth.net

RFC 7636 extension preventing authorization code injection and CSRF attacks in OAuth 2.0 Authorization Code flow.

The Authorization Code grant type is used by confidential and public clients to exchange an authorization code for an access token.

PKCE (Proof Key for Code Exchange) is an extension to the Authorization Code flow to prevent CSRF and authorization code injection attacks.

String credentials used by OAuth clients to make requests to resource servers, either as bearer or sender-constrained tokens.

String-based token for obtaining new access tokens without user interaction.

OAuth 2.0 default access token type: an opaque string used in the Authorization header to access protected resources without additional identity proof.

Scope mechanism in OAuth 2.0 to limit application access to user accounts.

The Client Credentials grant type is used by clients to obtain an access token outside of the context of a user.