What is OAuth 2.0 Authorization Code Flow?
The standard delegation flow where users approve access on the provider and the app exchanges a short-lived code for tokens server-side. BYOB-managed Google sign-in hides this handshake from project developers entirely.
Example
BYOB-managed Google sign-in runs this flow behind the scenes: the user approves on the provider, tokens land server-side, and project code receives a session without ever touching client secrets or code values.
What people get wrong
Running the legacy implicit flow that returns tokens in the URL fragment. Fragments leak through history and referrers; the code flow keeps tokens out of the browser address bar entirely.
Frequently asked questions
Why prefer the code flow over implicit?
Tokens travel through a back-channel exchange instead of the URL, so they avoid fragment leakage and gain PKCE and client authentication protections.
Related terms
PKCE (Proof Key for Code Exchange)
An OAuth extension that binds the authorization code to a secret the client created, blocking code interception on public clients. Mobile apps and browser-only clients should always send code_challenge with the request.
JWT Claims
The signed JSON assertions inside a JSON Web Token, such as subject, expiry, issuer, and role. Services trust claims only after verifying signature, issuer, audience, and expiration together.
Better Auth
Authentication with managed Google sign-in or email/password flows provisioned for generated apps. Auth pages (callbacks, sign-in) are private surfaces and stay noindexed like any other.
Magic Link / OTP
Passwordless sign-in: the user receives an email link or one-time code instead of inventing a password. Fewer credentials to phish, fewer reset flows to build, higher conversion than passwords.
Cross-Site Request Forgery (CSRF)
An attack that tricks a logged-in browser into submitting unwanted state-changing requests to a trusted site. SameSite cookies, anti-CSRF tokens, and origin checks break the forgery chain.
SQL Injection
An attack that smuggles database commands through unsanitized input into application queries. Parameterized statements and least-privilege database roles keep hostile input as data, never executable code.