← Back to Labs

OAuth 2 Flow Boundary Lab

Switch between public, confidential, and machine OAuth flows to see where the browser ends, where the token endpoint starts, and which credential actually carries the risk.

Clientapp or serviceBrowseruser-facing legAuthorizelogin + consentTokenback-channel exchangeAPIresource serverstate + code_challengeCode + PKCENormal flow pathPKCE is prepared before the browser leaves the app.Public client flow for SPAs and native apps
Step 1 / 7The app creates state and a PKCE verifier before any redirect

A public client cannot hide a long-term secret, so it starts by creating a one-time state value and a random PKCE verifier for this exact login attempt.

flow
Code + PKCE
browser involved
yes
final credential issued at
token endpoint
primary risk surface
callback + public client

Arrow keys to navigate · R to reset

Tap dots to jump to any step

Read the full article →Take the quiz →