title: What is the difference between the OAuth Authorization Code and Implicit workflows? When to use each one?
body: <p>OAuth 2.0 has multiple workflows. I have a few questions regarding the two.</p>
  
  <ol>
  <li><strong>Authorization code flow</strong> - User logs in from client app, authorization server returns an authorization code to the app. The app then exchanges the authorization code for access token.</li>
  <li><strong>Implicit grant flow</strong> - User logs in from client app, authorization server issues an access token to the client app directly.</li>
  </ol>
  
  <p>What is the difference between the two approaches in terms of security? Which one is more secure and why? </p>
  
  <p>I don't see a reason why an extra step (exchange authorization code for token) is added in one work flow when the server can directly issue an Access token.</p>
  
  <p>Different websites say that Authorization code flow is used when client app can keep the credentials secure. Why?</p>