Name at least three OAuth 2.0 grant types.

• A. Authorization Code, Client Credentials, Password (Resource Owner Password Credentials), and Refresh Token.
• B. Only Authorization Code is supported.
• C. OAuth 2.0 has no grant types.
• D. PKCE and Assertion grants only.

Answer: (A)

OAuth 2.0 provides several ways to obtain access tokens, each tailored to different client types and trust levels. The Authorization Code flow is used by web applications where the client can keep a secret; it involves redirecting the user to the authorization server to grant consent, then exchanging an authorization code for tokens. The Client Credentials flow serves machine-to-machine scenarios where no user is involved—the client authenticates itself to get an access token. The Resource Owner Password Credentials flow allows a trusted application to handle user credentials directly to obtain an access token, though it’s generally discouraged for new apps due to security concerns. The Refresh Token mechanism lets an application obtain a new access token without requiring the user to re-authenticate once the original token expires.

Other options fall short because there are multiple grant types supported, not just one; OAuth 2.0 does use refresh tokens to renew access, not that there are no grant types; and PKCE is an extension that strengthens the Authorization Code flow rather than a standalone, exclusive set of grant types.