Definition
The Authorization Code Flow is the OAuth 2.1 default grant type — the client redirects the user to the authorization server, receives an authorization code on callback, and exchanges it for tokens.
In more depth
OAuth 2.1 mandates PKCE for all clients using this flow (not just public/SPA clients). The exchange happens server-to-server, so the access token never appears in the browser URL.
This is the right default for almost every web application, native mobile app, and SPA in 2026. Implicit Flow is retired; ROPC is retired; Authorization Code + PKCE is the canonical flow.
Want the work, not just the definition?