

Your Auth0 Authorization Server responds with an ID Token and Access Token (and optionally, a Refresh Token). Your Auth0 Authorization Server verifies the code, Client ID, and Client Secret.
#Code on time data flow code
Your Auth0 Authorization Server redirects the user back to the application with an authorization code, which is good for one use.Īuth0's SDK sends this code to the Auth0 Authorization Server ( /oauth/token endpoint) along with the application's Client ID and Client Secret. The user authenticates using one of the configured login options and may see a consent page listing the permissions Auth0 will give to the regular web application. Your Auth0 Authorization Server redirects the user to the login and authorization prompt. The user clicks Login within the regular web application.Īuth0's SDK redirects the user to the Auth0 Authorization Server ( /authorize endpoint).
#Code on time data flow password

Call Your API Using the Client Credentials Flow.Mitigate Replay Attacks When Using the Implicit Flow.Call Your API Using the Authorization Code Flow with PKCE.Authorization Code Flow with Proof Key for Code Exchange (PKCE).

Call Your API Using the Authorization Code Flow.
