Why is the OAuth authorization code flow with PKCE preferred in SPAs?
PICTURE THIS: A SENTENCE BECOMES TOKENS
The model does not read letters like humans. It reads these pieces, then predicts the next one.
Simple meaning
The code flow keeps tokens off the URL fragment used by the implicit flow.
WHY — Auth instead of guessing?
Why interviewers care about Auth:
on Auth.
the situation, the default choice, and one exception - that reads as experience.
Name the idea, why it exists, then one short example.
End with when you use it and one common pitfall.
STEPS — What happens with tokens?
Before the model can read a sentence, it goes through these steps:
- 1The code flow keeps
tokens off the URL fragment used by the implicit flow.
- 2PKCE proves the same
client that started login is finishing it, which matters when you cannot hide a client secret in React.
- 3The Express backend still
performs the token exchange when you use a confidential server.
- 4Context mix
Attention looks at nearby tokens together.
- 5Next token
The model scores what should come next.
- 6Decode
IDs turn back into readable text.
EXAMPLE — See it in action
Let's see how a real sentence is tokenized (tokens may vary by model):
Note: Actual tokens and IDs depend on the tokenizer (e.g., GPT, Llama, etc.).
Key takeaway
The code flow keeps tokens off the URL fragment used by the implicit flow. PKCE proves the same client that started login is finishing it, which matters when you cannot hide a client secret in React.