Who participates?
The user owns a Bhauu Identity. The registered client application starts the request. Bhauu Auth authenticates the user and obtains consent. An application backend, when present, completes the code exchange and creates its own session.
Application→/oauth/authorize→Hosted sign-in→Callback with code→/oauth/token→Application session
Authorization request
Use response_type=code, registered client_id and exact redirect_uri, random state, requested scope=profile email, and a fresh code_challenge with code_challenge_method=S256. PKCE is required.
Why exchange a code?
The callback code is a one-time, short-lived grant, not an access token. The token endpoint checks the client, exact redirect URI, unused code, and matching PKCE verifier before issuing tokens. Never treat the code as a logged-in application session.