Why does authorization grant flow skip the authorization code just return an access token?

Question

I'm learning about O Auth 2 from here

I was wondering in the step of "Authorization server redirects user agent to client with authorization code", why doesn't the server just give the access token instead? Why give an authorization code that then is used to get the access token? Why not just give the access token directly? Is it because there there is a different access token for each resource so that you need to go through O Auth again to access a different resource?

Answer 1

The authorization grant code can pass through unsecured or potentially risky environments such as basic HTTP connection (not HTTPS) or a browser. But it's worthless without a client secret. The client can be a backend application. If the OAuth2 server returned a token, it could get compromised.

There is another OAuth2 flow - the Implicit flow , which returns an access token right after the authentication, but it's designed mainly for JavaScript applications or other deployments where it's safe to use it.