After a library-cardholder consents, the municipal app’s redirect URI receives an authorization code. A junior developer places that code in Authorization: Bearer on the first resource GET. Why is that wrong?
Select an answer to reveal the explanation.
Short Explanation
The code is a cloakroom ticket, not the coat. You cannot wear the ticket; you trade it at the counter (token endpoint) for the access token, then use that as Bearer on the resource.
Full Explanation
The redirect returns a short-lived authorization code. That code is not a resource credential and must not be used as a Bearer token. The next official step is a back-channel request to the token endpoint that exchanges the code for an access token. Only then does the consumer call the protected API.