# Code flow

## 3-legged OAuth

* Enables checking the identity of the 3 involved actors.

## OAuth server authenticates the resource owner

* Username + password or other means.

## OAuth server authenticates the client

* ClientID + ClientSecret + HTTP basic authorization.

## Client authenticates the OAuth server

* Certificate + URL.

## Requirements

* Confidential application types.
* Secure storage for tokens, ClientID and ClientSecret.

## Setup

* Client registration in the OAuth server.
  * Client receives ClientID and ClientSecret.
  * Not regulated by OAuth.

## Resource owner uses a server-based Web App

* The client.

## The client uses the resource server API to get a resource

* The resource server redirects the client to the OAuth server.

## The OAuth server authenticates the resource owner

* And sends an authorization grant to the client.

## The client gets an access token from the OAuth server

* Using its credentials (to have access permission).
* Using its authorization grant.

## The client uses again the resource server API to get a resource

* This time providing an access token.

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2Fgs4k5I6SMdrw0QHfNT7P%2Fa.png?alt=media&#x26;token=da0cd43c-c326-4507-b243-e310ab1f2e3e" alt=""><figcaption></figcaption></figure>
