In OAuth Authorization Code Grant Type Flow, what must occur before the AUTH CODE is issued?

• A. The user must authenticate with the Authorization Server.
• B. The client must authenticate with the resource server.
• C. The client must send the client ID to the resource server.
• D. The resource server validates the AUTH CODE.

Answer: (A)

Authentication of the user with the Authorization Server must occur before an authorization code is issued. The user is directed to log in (and grant consent) at the Authorization Server, which verifies their identity. Once the user is authenticated and has granted permission, the Authorization Server issues the authorization code to the client via the redirect URI. Only after obtaining this code does the client exchange it at the token endpoint for access (and possibly refresh) tokens. The other options describe steps that happen later or at different components of the flow, not the issuance of the code itself.