Software Design

OAuth 2.0 Authorization Code Lifecycle

State Diagrams · made in Skemio

State machine illustrating the OAuth 2.0 authorization code lifecycle: Issued, Validating, Redeemed, Revoked, and Expired states.
State machine illustrating the OAuth 2.0 authorization code lifecycle: Issued, Validating, Redeemed, Revoked, and Expired states.
Open it in SkemioMake your own

What it shows

  • Authorization codes have short lifespans, typically 60 to 300 seconds
  • Codes are strictly single-use; a second redemption revokes all tokens
  • PKCE code verifiers mathematically tie the exchange to the original client

The takeaway

OAuth codes must be strictly single-use: replay attempts trigger automatic token revocation.

More state diagrams