Explanation
Graphical user interface, text, application, email Description automatically generated

Oauth2 client_id client_secret
The authorization code flow begins with the client directing the user to the /authorize endpoint.
Box 1: token
Use the authorization code to request an access token.
Now that you've acquired an authorization code and have been granted permission by the user, you can redeem the code for an access token to the desired resource, by sending a POST request to the /token endpoint:
Box 2: authorization_code
Use the authorization code to request an access token.
Example:
// Line breaks for legibility only
POST /{tenant}/oauth2/token HTTP/1.1
Host: https://login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded
grant_type=authorization_code
etc.
Note: At a high level, the entire authorization flow for an application looks a bit like this:
Diagram Description automatically generated

Reference: https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-oauth-code