A civic permitting portal will use the OAuth2 three-legged authorization code grant so residents approve access to their profile API. What is the first hop the constructed flow must perform?
Select an answer to reveal the explanation.
Short Explanation
Three-legged starts by walking the resident to the front desk (authorization endpoint)—not by stuffing a password into the vault API or asking for tokens first. The user must be present for that first hop.
Full Explanation
The authorization-code grant begins by directing the resource owner’s user-agent to the authorization server with client id, redirect URI, response_type=code, scope, and state. POSTing a password to the resource API or hitting the token endpoint first skips the official three-legged start. Client-credentials is a different grant and is not the happy path here.