How does the OAuth 2.0 authorization code flow with PKCE work?

OAuth2 is an authorization framework, not a login protocol. The client asks for scoped access to a resource on behalf of a user. The authorization code flow keeps tokens out of the browser URL by exchanging a short-lived code on a back channel.

The flow

• The client generates a random code verifier and a challenge derived from it
• It redirects the user to the authorization endpoint with client id, redirect URI, scope, state and challenge
• The user authenticates and consents at the authorization server
• The server redirects back with a code and the original state
• The client verifies state, then exchanges the code and verifier at the token endpoint
• The server returns an access token, optional refresh token and, with OpenID Connect, an id token

GET /authorize?response_type=code
  &client_id=web-app
  &redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback
  &scope=openid%20profile%20orders.read
  &state=random-value
  &code_challenge=base64url-sha256
  &code_challenge_method=S256 HTTP/1.1
Host: auth.example.com

The client secret must never live in a public browser or mobile app. PKCE exists so public clients can use the code flow safely. Confidential server-side clients still use a secret in addition. The implicit flow is deprecated for new applications because it exposes tokens in the URL.