An exam-style review for the city’s identity team asks for the official happy-path order of the OAuth2 authorization code grant. Which sequence is correct?
Select an answer to reveal the explanation.
Short Explanation
Remember the parade order: invite the person (authorize), collect the ticket (code), trade at the booth (token), then enter the exhibit (resource). Any other lineup breaks the official grant.
Full Explanation
The official three-legged authorization-code sequence is authorize with the resource owner present, receive the authorization code, exchange it at the token endpoint, then call the resource with the access token. Hitting the resource before a token exists or asking the token endpoint before user authorization is the wrong grant order.