Where the token actually comes from
A user signs in to an application through an identity provider. The application ends up holding an access token, and most people can name every box in this diagram without being able to say what order they're touched in.
One hop matters more than the rest: the code the browser carries is not the token, and the exchange that turns one into the other never goes through the browser at all.
Boundaries, outermost first: Back channel · the browser never sees this: API call (with the token), Code exchange (server to server) Outside every boundary: Browser (starts sign-in), Application (redirects them out), Identity provider (authenticates), Redirect back (carries a short code) Connections: Browser calls Application — sign in Application sends outbound traffic to Identity provider — redirect out Identity provider sends outbound traffic to Redirect back — redirect home Redirect back calls Code exchange — hands over the code Code exchange calls API call — token in hand