Authorization Code + PKCE
The default OAuth grant for user-facing apps — the client gets a short-lived authorization code first and exchanges it for tokens, with PKCE proving the exchange came from the same client that started the flow.
aka: PKCE
PKCE (Proof Key for Code Exchange) closes a gap in public clients — mobile and single-page apps that can’t hold a client secret — by binding the authorization code to a value only the requesting client knows. OAuth 2.1 makes it mandatory for every Authorization Code flow, not just the public-client case it was originally designed for.