sysop@hub:~/explainers/oauth-flow-explained$

oauth-flow-explained

OAuth 2.0 authorization code flow with PKCE

How an app signs a user in and gets tokens from Microsoft Entra ID, step by step.

Read the steps as text

Click Sign in. The user starts sign-in in the app.
Authorization request. The app redirects the browser to the authorization endpoint with client_id, redirect_uri, scope, a random state value and a PKCE code_challenge.
Sign-in, MFA, consent. Entra ID authenticates the user, applies Conditional Access and MFA, and asks for consent to the requested permissions if needed.
Redirect with code. Entra ID sends the browser back to the redirect_uri with a short-lived authorization code and the state value. The app checks that state matches. The code alone is useless without the PKCE code_verifier.
Token request. The app sends the code and the PKCE code_verifier to the token endpoint. Confidential clients also prove themselves with a secret or certificate.
Tokens. Entra ID returns an access token, an ID token when the openid scope was requested, and a refresh token when offline_access was requested.
Call API with token. The app calls the API with the access token in the Authorization: Bearer header.
Response. The API validates signature, issuer, audience, expiry and scopes before it answers.

The state value protects against cross-site request forgery. PKCE protects against a stolen authorization code and is recommended for all clients.
Access tokens are short-lived, usually around an hour. A refresh token gets new ones without another sign-in.
Errors in this flow show up as AADSTS codes, for example 65001 for missing consent at the sign-in step or 50011 for a redirect URI mismatch.