What is OAuth 2.0 Flows? — UK Software Development Guide
Direct Answer
OAuth 2.0 defines several authorisation "flows" for different use cases: Authorisation Code Flow (for web apps — user redirected to authorisation server, code exchanged for tokens), Authorisation Code with PKCE (for SPAs and mobile apps — adds Proof Key for Code Exchange security extension), Client Credentials Flow (for machine-to-machine communication — no user involved), and Device Authorisation Flow (for input-limited devices).
Oauth-flows in the UK
UK government APIs predominantly use Authorisation Code with PKCE: HMRC MTD OAuth 2.0 requires PKCE, NHS Login uses OIDC (which builds on OAuth 2.0 Authorisation Code + PKCE), and GOV.UK Verify used OAuth 2.0 before being replaced by NHS Login. The GDS API design guide recommends Authorisation Code with PKCE for all user-delegated OAuth 2.0 flows in government services. Client Credentials is used for machine-to-machine government API access (Companies House API, for example).
Related Glossary Terms
API
API explained for UK software developers and business owners. An API (Application Programming Interface) is a defined set of rules and protocols that allows different software system... UK context, examples, and related services.
Microservices
Microservices explained for UK software developers and business owners. Microservices architecture is a software design approach where an application is built as a collection of small, indepen... UK context, examples, and related services.
Open Banking
Open Banking explained for UK software developers and business owners. Open Banking is the UK's implementation of PSD2 (Payment Services Directive 2) — a regulatory framework that requires th... UK context, examples, and related services.
GRAPHQL
GraphQL explained for UK software developers. GraphQL is a query language for APIs and a server-side runtime for executing those queries, developed by Meta (Facebook)... UK context and related services.
OAUTH
OAuth 2.0 explained for UK software developers. OAuth 2.0 is an authorisation framework that allows applications to obtain limited access to a user's account on another...
Nodejs
Node.js explained for UK software developers. Node.js is an open-source, cross-platform JavaScript runtime environment that executes JavaScript code outside a web bro...
Get Expert Advice on Oauth-flows
Speak with our UK software development experts about Oauth-flows. Free consultation, transparent pricing, no obligation.