Card 10/ 11
Practice: The Right Flow for Four Applications
A single-page app, a mobile app, a nightly billing job and a server-rendered website.
Choosing an OAuth flow means asking whether a user is involved and whether the client can keep a secret. For each application, choose the grant, say which tokens it receives, and give the reason.
- A single-page app in the browser that shows a user's calendar from a calendar API.
- A mobile app that lets a user sign in with an identity provider and posts to their account.
- A nightly job that reads every account's usage from a billing API.
- A server-rendered website that signs users in and calls an API for them.
Show the answers
| Application | Grant | Tokens | Reason |
|---|---|---|---|
| Single-page app | Authorization code with PKCE | Access token, refresh token with rotation | A user is involved; a public client cannot hold a secret; implicit is retired |
| Mobile app | Authorization code with PKCE, plus the openid scope | Access, ID and refresh tokens | A user signs in; the system browser handles login, per RFC 8252 |
| Nightly billing job | Client credentials | Access token only | No user; the job acts for itself |
| Server-rendered website | Authorization code with PKCE and a client secret, plus openid | Access, ID and refresh tokens, kept on the server | A confidential client still uses PKCE |
← → move through sections and cards