 <p>From the <a href="http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-1.3.1">OAuth 2.0 Spec</a>:</p> <blockquote> <p>The authorization code provides a few important security benefits such as the ability to authenticate the client, and the transmission of the access token directly to the client without passing it through the resource owner's user-agent, potentially exposing it to others, including the resource owner.</p> </blockquote> <p>So, basically - the main reason is to limit the # of actors getting the access token.</p> <p>"token" response is intended primarily for clients that live in the browser (e.g.: JavaScript client).</p>