Q8: What are the main OAuth 2.0 Grant Types and when should each be used?
OAuth 2.0 provides several grant types tailored for different application architectures:
- Authorization Code Grant + PKCE: For Single Page Apps (SPAs), Mobile Apps, and Web Applications.
- Client Credentials Grant: For machine-to-machine (M2M) communication without user context.
- RefreshToken Grant: Used by clients to obtain new access tokens when current access tokens expire.
- Resource Owner Password Credentials (Deprecated): Legacy flow where user gives credentials directly to client; strictly disallowed in OAuth 2.1.
- Implicit Grant (Deprecated): Legacy SPA flow that returned tokens in URL fragments; completely removed in OAuth 2.1 in favor of PKCE.
Key Takeaways
- Authorization Code + PKCE is the universal standard for user-facing applications.
- Client Credentials Grant is intended exclusively for server-to-server daemon processes.