The most common is the implicit flow.

The most secure is the code flow, but it's more complex to implement as it requires more steps. As it is more complex, many providers end up suggesting the implicit flow.

/// note

It's common that each authentication provider names their flows in a different way, to make it part of their brand.

import static java.lang.annotation.ElementType.METHOD;
import static java.lang.annotation.ElementType.TYPE;
import static java.lang.annotation.RetentionPolicy.RUNTIME;

/**
 * Explicitly specifies the types that should be used for dependency injection.
 * <p>
 * This annotation allows you to limit which types of a bean should be available

  # Options for controlling the logger.
  logger:
    level: "debug"
    format: "text" # can also be "json"

# Default values shown below
oauth2:
  # use ["code", "token", "id_token"] to enable implicit flow for web-only clients
  responseTypes: [ "code", "token", "id_token" ] # also allowed are "token" and "id_token"
  # By default, Dex will ask for approval to share data with application

 * char}, {@code short}, {@code int}, {@code float}, {@code double}, and {@code long} values.
 *
 * <p><b>Note:</b> This class intentionally violates the specification of its supertype {@code
 * DataOutput}, which explicitly requires big-endian byte order.
 *
 * @author Chris Nokleberg
 * @author Keith Bottner
 * @since 8.0
 */
@J2ktIncompatible
@GwtIncompatible

             * created for it because the original is potentially being actively
             * referenced by other objects. We must populate the existing object's
             * data explicitly (and carefully).
             */
            if (!addrFound && this.queryAddress.hostName.hexCode == hexCode
                    && (this.queryAddress.hostName.isUnknown() || this.queryAddress.hostName.name.equals(n))) {

import org.jspecify.annotations.Nullable;

/**
 * A simplistic set which implements the bare minimum so that it can be used in tests without
 * relying on any specific Set implementations. Slow. Explicitly allows null elements so that they
 * can be used in the testers.
 *
 * @author Regina O'Dell
 */
@GwtCompatible
@NullMarked

import org.jspecify.annotations.Nullable;

/**
 * A simplistic set which implements the bare minimum so that it can be used in tests without
 * relying on any specific Set implementations. Slow. Explicitly allows null elements so that they
 * can be used in the testers.
 *
 * @author Regina O'Dell
 */
@GwtCompatible
@NullMarked

     */
    @Nonnull
    Collection<Profile> getProfiles();

    /**
     * List of profile ids that have been explicitly activated by the user.
     */
    @Nonnull
    List<String> getActiveProfileIds();

    /**
     * List of profile ids that have been explicitly deactivated by the user.
     */
    @Nonnull
    List<String> getInactiveProfileIds();

    /**

   * however, {@code asMap().get(Object)} returns {@code null} instead of an empty collection.
   *
   * <p>Though the method signature doesn't say so explicitly, the returned map has {@link
   * SortedSet} values.
   */
  @Override
  public Map<K, Collection<V>> asMap() {
    return super.asMap();
  }

  /**
   * {@inheritDoc}
   *

* `oauth2`: todas as formas do OAuth2 para lidar com segurança (chamados "fluxos").
    * Vários desses fluxos são apropriados para construir um provedor de autenticação OAuth2 (como Google, Facebook, X (Twitter), GitHub, etc):
        * `implicit`
        * `clientCredentials`
        * `authorizationCode`
    * Mas existe um “fluxo” específico que pode ser perfeitamente usado para resolver autenticação diretamente na mesma aplicação: