title: oauth implicit grant vs authorization code grant?
body: <p>I would like to better understand the difference's between the implicitly grant flow and the authorization code grant flow as i'm not sure that my current understanding is correct. </p>
  
  <ol>
  <li>Is the implicitly grant flow primarily used by front-end applications to authenticate the user? </li>
  <li>Does the implicitly grant flow only require a client_id, username &amp; password to authenticate, in other words the client_secret is never sent?</li>
  <li>Is a authorization codes only a short lived token?</li>
  <li>After an authorization code has been exchanged for a access token, how long can the client access the users account for? Specifically, if the client is a long running script, does the user need to authenticate each time the script runs? Or can we assume that after the user has authorized once that the client has permission to access the user when ever it needs to (unless the user revokes access) and as such it just needs to authenticate using the client credentials?</li>
  <li>What is the advantage of using the authorization code flow over the implicitly flow?</li>
  <li>Does the resource server it's self need a client id?</li>
  </ol>
  
  <p>Thanks</p>