docs/oauth-flow.svg
<?xml version="1.0" encoding="utf-8" standalone="no"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 20010904//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd"><svg xmlns="http://www.w3.org/2000/svg" width="685" height="592" xmlns:xlink="http://www.w3.org/1999/xlink"><source><![CDATA[Client->OAuth Server: Authenticate\n(to get profile)
Note right of OAuth Server: OAuth server\nmay do authorisation here
OAuth Server->Client: Authentication Code
Client-->OAuth Server: Authentication Code
Note right of OAuth Server: Token endpoint uses the code\nto get an access token
OAuth Server-->Client: Access Token
Note over Client,OAuth Server: The access token is now\n used to access custom \nendpoints on the server\n(eg to get user profile data)]]></source><desc></desc><defs><marker viewBox="0 0 5 5" markerWidth="5" markerHeight="5" orient="auto" refX="5" refY="2.5" id="markerArrowBlock"><path d="M 0 0 L 5 2.5 L 0 5 z"></path></marker><marker viewBox="0 0 9.6 16" markerWidth="4" markerHeight="16" orient="auto" refX="9.6" refY="8" id="markerArrowOpen"><path d="M 9.6,8 1.92,16 0,13.7 5.76,8 0,2.286 1.92,0 9.6,8 z"></path></marker></defs><g class="title"></g><g class="actor"><path d="M10,20C21.4,17.1 70.0,22.9 81.4,20.0C79.7,52.7 83.1,30.3 81.4,63.0C70.0,60.1 55.4,65.9 10.0,63.0C8.3,30.3 11.7,52.7 10.0,20.0" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"></path><text x="20" y="44" style="font-size: 16px; font-family: danielbd;"><tspan x="20">Client</tspan></text></g><g class="actor"><path d="M10,529.15625C29.8,532.0 33.0,526.3 81.4,529.2C83.1,565.3 79.7,536.0 81.4,572.2C21.4,575.0 70.0,569.3 10.0,572.2C8.3,545.3 11.7,561.8 10.0,529.2" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"></path><text x="20" y="553.15625" style="font-size: 16px; font-family: danielbd;"><tspan x="20">Client</tspan></text></g><path d="M45.7,63.0C27.1,291.9 64.4,220.5 45.7,529.2" stroke="#000000" fill="none" style="stroke-width: 2;"></path><g class="actor"><path d="M206.4296875,20C281.1,14.2 320.3,25.8 352.3,20.0C354.1,56.1 350.6,52.7 352.3,63.0C295.5,57.2 329.0,68.8 206.4,63.0C204.7,34.0 208.1,37.4 206.4,20.0" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"></path><text x="216.4296875" y="44" style="font-size: 16px; font-family: danielbd;"><tspan x="216.4296875">OAuth Server</tspan></text></g><g class="actor"><path d="M206.4296875,529.15625C241.4,523.3 289.9,535.0 352.3,529.2C354.1,539.5 350.6,561.8 352.3,572.2C229.8,578.0 329.0,566.3 206.4,572.2C204.7,557.4 208.1,536.0 206.4,529.2" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"></path><text x="216.4296875" y="553.15625" style="font-size: 16px; font-family: danielbd;"><tspan x="216.4296875">OAuth Server</tspan></text></g><path d="M279.4,63.0C298.0,319.4 260.7,248.5 279.4,529.2" stroke="#000000" fill="none" style="stroke-width: 2;"></path><g class="signal"><text x="98.6328125" y="80.90625" style="font-size: 16px; font-family: danielbd;"><tspan x="98.6328125">Authenticate</tspan><tspan dy="1.2em" x="98.6328125">(to get profile)</tspan></text><path d="M45.7,125.2C116.6,134.5 183.8,115.8 279.4,125.2" stroke="#000000" fill="none" style="stroke-width: 2; marker-end: url("#markerArrowBlock");"></path></g><g class="note"><path d="M299.3828125,145.1875C356.6,135.7 337.5,154.7 537.6,145.2C535.5,162.5 539.7,184.9 537.6,197.4C356.6,206.9 400.7,187.8 299.4,197.4C297.3,173.4 301.5,180.0 299.4,145.2" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"></path><text x="304.3828125" y="164.1875" style="font-size: 16px; font-family: danielbd;"><tspan x="304.3828125">OAuth server</tspan><tspan dy="1.2em" x="304.3828125">may do authorisation here</tspan></text></g><g class="signal"><text x="75.0703125" y="224.875" style="font-size: 16px; font-family: danielbd;"><tspan x="75.0703125">Authentication Code</tspan></text><path d="M279.4,240.4C242.0,249.7 212.5,231.0 45.7,240.4" stroke="#000000" fill="none" style="stroke-width: 2; marker-end: url("#markerArrowBlock");"></path></g><g class="signal"><text x="75.0703125" y="267.875" style="font-size: 16px; font-family: danielbd;"><tspan x="75.0703125">Authentication Code</tspan></text><path d="M45.7,283.4C89.5,274.0 102.1,292.7 279.4,283.4" stroke="#000000" fill="none" style="stroke-width: 2; stroke-dasharray: 6, 2; marker-end: url("#markerArrowBlock");"></path></g><g class="note"><path d="M299.3828125,303.375C450.1,313.9 362.7,292.8 563.0,303.4C560.9,322.1 565.1,311.7 563.0,355.6C418.4,345.0 499.7,366.1 299.4,355.6C297.3,319.9 301.5,320.2 299.4,303.4" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"></path><text x="304.6640625" y="322.375" style="font-size: 16px; font-family: danielbd;"><tspan x="304.3828125">Token endpoint uses the code</tspan><tspan dy="1.2em" x="304.3828125">to get an access token</tspan></text></g><g class="signal"><text x="106.296875" y="383.0625" style="font-size: 16px; font-family: danielbd;"><tspan x="106.296875">Access Token</tspan></text><path d="M279.4,398.6C101.8,407.9 117.9,389.2 45.7,398.6" stroke="#000000" fill="none" style="stroke-width: 2; stroke-dasharray: 6, 2; marker-end: url("#markerArrowBlock");"></path></g><g class="note"><path d="M35.7109375,418.5625C76.3,428.7 248.8,408.4 289.4,418.6C293.0,487.4 285.8,467.7 289.4,509.2C228.5,499.0 96.6,519.3 35.7,509.2C39.3,435.1 32.1,494.7 35.7,418.6" stroke="#000000" fill="#ffffff" style="stroke-width: 2;"></path><text x="40.7109375" y="437.5625" style="font-size: 16px; font-family: danielbd;"><tspan x="40.7109375">The access token is now</tspan><tspan dy="1.2em" x="40.7109375">used to access custom</tspan><tspan dy="1.2em" x="40.7109375">endpoints on the server</tspan><tspan dy="1.2em" x="40.7109375">(eg to get user profile data)</tspan></text></g></svg>