The main purpose of this flow is to completely prevent a client application from ever being exposed to the resource owner's credentials. To this end, the token can only be obtained by redirecting the user-agent to the authorization server, who then authenticates the user, and then redirects the user-agent back to the client application with a valid token.
This type of flow is also referred to as a Three-Legged OAuth, mainly because a client application alone cannot get access to a protected resource without the resource owner's consent. This means that the flow involves an additional whereby the authorization server obtains consent by the resource owner as part of the flow.
The flow is as follows:
Implicit grant flow
- A resource ...
