Server support and implicit-flow limits
09Supporting native apps means more than accepting one mobile callback format.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 8.2 ↗
RFC 8252 · § 8.2EXAMPLE
3 / 3
03
Deliver an authorization code to the app.
The app exchanges it with its verifier at the token endpoint.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Support the browser-based code pattern end to end.
- Servers must support the three redirect options, public-client registration, and PKCE (Appendix A).
- The implicit flow is NOT RECOMMENDED for native apps because it cannot be protected with PKCE.
- Platform-specific examples in Appendix B are historical implementation notes, not a promise of current platform APIs.
This guide explains protocol boundaries. Check current platform documentation when selecting a browser-session API.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy