2. Read token from query

You have now been redirected back to the application, to the page that was specified in the redirect-url parameter. In the URL you can notice, that there are addtional query parameters:

Let's break it down...

• state=

  The state parameter is an opaque value used by the client to maintain state between the request and the callback. Essentially, it is used to prevent Cross-Site Request Forgery (CSRF) attacks and to ensure the response belongs to the request made by the client.

• access_token=

  This is the actual access token, which allows the client application to access the user's protected resources on the resource server (e.g., user profile, photos, etc.).

As the last thing, the client should verify that state we have sent () equivalent to the one we received back (). If not, someone is tampering with us.

And this concludes the Implicit Flow.

Please be aware that by using the Implicit flow, you are making your application vulnerable to various attacks, which is why this flow is deprecated in OAuth 2.0 and removed in OAuth 2.1.

Just use Authorization flow with PKCE everywhere you can.