Hybrid Code Flow for Authentication

As the name suggests, this flow is a mix of Authorization code flow and Implicit code flow.

In Authorization flow, we first get authorization token from authorization endpoint and then get the access token and identity token from the token endpoint. This takes some time as two server calls are needed.

In the implicit flow, we get the access token and identity token from the authorization endpoint. This is faster but is not secure.

In the hybrid flow, the client gets immediate access to the identity token from the authorization endpoint itself. The client also gets the authorization code from the authorization endpoint. Later, it fetches the access token from the token endpoint which can be used to get further user info.