A confidential client for a city GIS portal holds an authorization code after resident consent. Which step correctly obtains the access token?
Select an answer to reveal the explanation.
Short Explanation
The trade happens backstage: server calls the token desk with the code, secret, matching redirect URI, and grant_type=authorization_code. Doing that swap in a public browser bundle leaks the client secret.
Full Explanation
A confidential client exchanges the authorization code at the token endpoint using its client secret, the same registered redirect URI, and grant_type=authorization_code. That hop is server-side. Performing the exchange in front-end code exposes the secret. The token endpoint—not the resource API and not a dashboard form—issues the access token.