Exam 350-901 topic 1 question 364 discussion

It would be B if the B line would say the following: Exchange authorization codes for tokens by using the authentication server. https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow

A. Use authorization codes to access protected resources when approved: Explanation: This step is crucial in the OAuth2 authorization code grant flow. After the client receives an authorization code, it exchanges this code for an access token, which is then used to access protected resources. The access token represents the user’s authorization to access specific resources.

Cannot be A because authorization codes are NOT used to access protected resources, however Tokens are used which is what B states

A. Use authorization codes to access protected resources when approved. The three-legged OAuth2 authorization code grant flow generally involves these steps: The client (usually a web browser) requests authorization from the resource owner (usually by directing them to an authorization server with a request for access). Once the resource owner authorizes the request, the authorization server redirects the client back to the application with an authorization code. The client then exchanges this authorization code for an access token by making a request to the authorization server. The access token is then used by the client to access the protected resources. So, the authorization codes are used to access protected resources when approved.

3 Leg type, 2nd phase