Client starts the authorization flow and obtains approval from the Authorization Server to act on the User's behalf. The approval is required, but the details are not specified in the OAuth2 specification. At this point, if successful, the Authorization Server issues an authorization code (opaque one-time token).