title: In OAuth 2.0 what is the function of the authorization code?
body: <p>My question is related to this blog post:
  <a href="https://developer.okta.com/blog/2019/10/21/illustrated-guide-to-oauth-and-oidc" rel="nofollow noreferrer">https://developer.okta.com/blog/2019/10/21/illustrated-guide-to-oauth-and-oidc</a></p>
  <p>In step 5, the authorization server returns an authorization code to the client:
  <a href="https://i.stack.imgur.com/MZZFs.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/MZZFs.png" alt="enter image description here" /></a></p>
  <p>Right after that in step 6 the client returns this authorization code back to the server, together with Client ID and Client secret, and receives the access token. Whats the purpose of this &quot;Authorization Code round trip&quot;?
  <a href="https://i.stack.imgur.com/GHqV8.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/GHqV8.png" alt="enter image description here" /></a></p>