In the OAuth Authorization Code Grant Type Flow, how does the client get AUTH CODE?

• A. The Authorization Server sends the AUTH CODE after the User has authenticated himself with the Authorization Server.
• B. The client generates the AUTH CODE.
• C. The user provides the AUTH CODE to the client.
• D. The AUTH CODE is obtained after client credentials are validated by the resource server.

Answer: (A)

In this flow, the authorization code is created by the Authorization Server after the user has authenticated (and typically consented). The server then redirects the user back to the client with the code in the redirect URI. The client uses that code at the token endpoint to obtain an access token, proving its identity with its credentials. So the authorization server issuing the code after user authentication is the correct mechanism.

The other ideas don’t fit: the client does not generate the code; the user does not hand the code directly to the client outside the redirect; and the code isn’t granted after the resource server validates client credentials.