qqp question1: Why does OAuth server return a authorization code instead of access token in the first step? question2: How do I make an OAuth 2.0 provider that doesn't need to store the authorization code and token?