In the OAuth Authorization Code Grant Type Flow, how does the client get ACCESS_TOKEN?

• A. The client receives the ACCESS_TOKEN after sending the Authorization Server it's AUTH CODE, client ID, and client Secret.
• B. The ACCESS_TOKEN is returned with the AUTH CODE only.
• C. The client must exchange the AUTH CODE for a refresh token only.
• D. The ACCESS_TOKEN is pre-issued.

Answer: (A)

In this flow, the temporary authorization code is exchanged on the back-channel for tokens. After the user authenticates, the client receives an authorization code and then makes a server-to-server request to the token endpoint, presenting that code along with its client credentials (for confidential clients, the client_secret is required; redirect_uri may also be included). The authorization server validates these and responds with an access_token (and often a refresh_token) that the client can use to access resources. The authorization code by itself is not the access token—it must be exchanged for one through that token request.

That’s why the correct idea is that the client gets the ACCESS_TOKEN after sending the AUTH CODE plus its client credentials to the token endpoint. The other options don’t fit: the code alone doesn’t grant the token, token issuance isn’t only a refresh token, and tokens aren’t pre-issued.