Careeroza
Grant Types
Choosing a Flow
A grant type (or flow) is the way a client gets a token. OAuth 2.1 and current best practice keep only a few:
| Grant type | Use it for | User involved? |
|---|---|---|
| Authorization code + PKCE | Web apps, SPAs (React), mobile apps — any app where a user logs in | Yes |
| Client credentials | Service-to-service calls (order-service → payment-service), cron jobs | No |
| Refresh token | Getting a fresh access token when the old one expires | No (already logged in) |
| Device code | Smart TVs, CLIs — devices without a good browser | Yes, on another device |
| Deprecated: token returned in the URL fragment, easy to leak | — | |
| Deprecated: the client sees the user's password | — |
Rules of Thumb
- If a human logs in, use authorization code with PKCE. Always — even for confidential server-side clients.
- If a machine calls an API on its own behalf, use client credentials.
- Keep access tokens short-lived and use refresh tokens (with rotation) for long sessions.
- Never put a client secret in a React or mobile app: anyone can read it from the bundle. Such apps are public clients and rely on PKCE instead.
Note: You may still see the password grant in old tutorials ("send username and password to /oauth/token"). Keycloak still allows it for testing (direct access grants), but do not build production logins on it.