What are the two main phases of the OAuth 2.0 Authorization Code Grant Type flow?

• A. Authorization Code Flow and Exchange Authorization Code for Access Token Flow
• B. Implicit Flow and Client Credentials Flow
• C. Resource Owner Password Credentials Flow and Device Authorization Flow
• D. Authorization Code Flow and Refresh Token Flow

Answer: (A)

The two main phases are: first, the Authorization Code Flow, where the user authenticates and an authorization code is obtained via the authorization server; second, the Exchange Authorization Code for Access Token Flow, where that code is sent to the token endpoint to obtain an access token (and optionally a refresh token). This separation keeps user credentials and tokens secure by using a back-channel exchange rather than exposing tokens to the user-agent. Other flows mentioned correspond to different OAuth 2.0 patterns and do not describe these two phases of the Authorization Code grant.