A walkthrough of the OAuth 2.0 authorization code flow using GitHub and Google as examples. Covers all five steps: app registration, redirecting the user to the provider, receiving the authorization code, exchanging it for an access token, and fetching the user profile. Also explains Google's OpenID Connect layer, the state parameter for CSRF protection, PKCE for mobile/SPA apps, and how to choose minimal scopes. Includes concrete curl and JavaScript code samples for each server-side step.
Table of contents
The playersThe authorization code flowGoogle: same flow, plus OpenID ConnectState and PKCEScopes: ask for the minimumYou rarely hand-roll this316 Impressions