title: Why is there an "Authorization Code" flow in OAuth2 when "Implicit" flow works so well?
body: <p>With the &quot;Implicit&quot; flow the client (likely a browser) will get a access token, after the Resource Owner (i.e. the user) gave access.</p>
  <p>With the &quot;Authorization Code&quot; flow however, the client (usually a web server) will only get an authorization code after the Resource Owner (i.e. the user) gave access. With that authorization code the client then makes another call to the API passing client_id and client_secret together with the authorization code to obtain the access token. <a href="https://aaronparecki.com/articles/2012/07/29/1/oauth2-simplified" rel="nofollow noreferrer">All well described here</a>.</p>
  <p>Both flows have the exact same result: an access token. However, the &quot;Implicit&quot; flow is much simpler.</p>
  <p>The question: <strong>Why bother with &quot;Authorization Code&quot; flow, when &quot;Implicit&quot; flow seems to work just fine? Why not just use &quot;Implicit&quot; for webserver?</strong></p>
  <p>It's more work both for the provider and the client.</p>