An exam-style review for the city’s identity team asks for the official happy-path order of the OAuth2 authorization code grant. Which sequence is correct?
Select an answer to reveal the explanation.
Short Explanation
Remember the parade order: invite the person (authorize), collect the ticket (code), trade at the booth (token), then enter the exhibit (resource). Any other lineup breaks the official grant.
Full Explanation
Official authorization-code order for the city’s identity review is fixed: authorize with the user present, receive the code at the redirect URI, exchange at the token endpoint, then call the resource with the access token. That sequence is the happy path DEVCOR expects and the lineup civic SSO must construct when residents approve profile access.
Hitting the token endpoint first, then the resource, then the browser authorize reverse the dependencies—no code or user consent exists yet. Starting with a resource GET to “discover scopes,” then client-credentials, then refresh mixes discovery folklore with a two-legged grant and skips the code path entirely. Delivering an implicit token in the redirect fragment and skipping the token endpoint abandons the back-channel exchange the official path requires. Post the ordered hop list on the identity team’s runbook next to the permitting and library portal diagrams so reviewers share one sequence. Any proposed shortcut that collapses authorize and token into one browser hop should be flagged as leaving the official code-grant path.
Exam caveat: memorize authorize → code → token → resource as an ordered construction, not a bag of interchangeable hops you can reshuffle. Operational check: trace one portal login and label each hop in order; fail the review if token or resource traffic precedes a completed authorize redirect and code receipt.