The Authorization Code Flow is an OAuth 2.0 method in which an application redirects a user to an authorization server to sign in and approve access. The server sends a short-lived authorization code back to the application, which exchanges it at the token endpoint for an access token. The code is not itself a token granting access.
This design keeps access tokens out of the browser-facing redirect, but its protections depend on correct implementation. Applications should validate the redirect URI and use a state value to defend against request forgery. PKCE adds a verifier tied to the original request, so an intercepted code cannot normally be exchanged without it. In real attacks, flaws in code handling or PKCE checks can put tokens or accounts at risk; defenders should use maintained OAuth libraries and review the complete redirect and token-exchange path.