Authorization Code + PKCE is the modern secure standard for all client types.

OAuth2 & OIDC — Delegated Authorization & Identity

OAuth 2.0 is a delegation framework — it lets users grant apps limited access to their resources without sharing passwords. OIDC (OpenID Connect) adds identity on top: an ID Token with user profile claims. Microsoft Entra ID implements both. The Authorization Code + PKCE flow is the only recommended flow for public clients in 2026.

Interactive Pipeline Flow

AuthorizationToken IssuanceIdentity (OIDC)

🔀 Auth Request — Client → AS

Auth Request: client redirects user to /authorize with client_id, response_type=code, redirect_uri, scope, state, and PKCE code_challenge.

Architecture Diagrams

Authorization Code + PKCE flow — the recommended auth flow for SPAs and mobile apps.

Loading diagram...

Discussion