---
title: "04: OAuth 2.1 Authorization Code Flow"
source: Panaversity Learn Agentic AI
source_url: https://github.com/panaversity/learn-agentic-ai
licence: Apache-2.0
domain: agentic-ai
subdomain: panaversity-agentic
date_added: 2026-04-25
---

# 04: OAuth 2.1 Authorization Code Flow

**Objective:** Implement the full, user-interactive Authorization Code Flow to acquire an access token from the Authorization Server (AS).

This is the heart of the OAuth process. We will bring together all the pieces from the previous lessons: the client will redirect the user to the AS for login, the user will grant consent, the AS will redirect the user back to the client with a temporary code, and the client will exchange that code for a real access token.

## Key MCP and OAuth Concepts

-   **Authorization Code Flow:** The most secure OAuth flow for web and native applications. It ensures that the valuable access token is never exposed in the user's browser.
-   **`authorization_endpoint`:** The URL on the AS where the user is sent to log in and approve the client's request.
-   **Request Parameters (`response_type`, `client_id`, `redirect_uri`, `scope`, `state`, `resource`):**
    -   `response_type=code`: Specifies that we are using the Authorization Code Flow.
    -   `state`: A random string generated by the client to prevent CSRF attacks.
    -   `resource`: The **Resource Indicator (RFC 8707)**. This is the MCP server's unique identifier, which is **REQUIRED** by the MCP spec. It tells the AS which audience the token is for.
-   **Local Web Server:** The client needs to run a temporary, local web server to listen for the redirect from the AS at its `redirect_uri` (e.g., `http://localhost:8888/callback`).
-   **Authorization Code:** A short-lived, one-time-use code sent back to the client after successful user login.
-   **`token_endpoint`:** The URL on the AS where the client exchanges the authorization code (along with its `client_id` and `client_secret`) for an access token.

## Implementation Plan

-   **`authorization_server_mock.py`:**
    -   The AS will be updated to handle requests to its `authorization_endpoint` and `token_endpoint`.
    -   `GET /authorize`: Will display a simple (mocked) login and consent page to the user. Upon "approval," it will redirect the user back to the client's `redirect_uri` with an `authorization_code` and the original `state`.
    -   `POST /token`: Will accept an authorization code, validate it, and if valid, issue a signed JWT (the access token).

-   **`client.py`:**
    -   After discovering the AS and registering itself, the client will:
    1.  Start a local web server in a background thread to listen on its `redirect_uri`.
    2.  Construct the full authorization URL, including `client_id`, `state`, `redirect_uri`, and the `resource` parameter pointing to the MCP server.
    3.  Open the user's web browser to this URL.
    4.  The user interacts with the mock AS and is redirected back. The local server catches the request and extracts the `authorization_code`.
    5.  The client then makes a `POST` request to the AS's `token_endpoint`, exchanging the code for an access token.
    6.  Finally, the client prints the received access token to confirm the entire flow was successful.
