Hybrid flows

Hybrid flows (part of the OIDC specification) mix authorization code grant and implicit flows together, enabling the issuing of access tokens and ID tokens at different phases compared to when those flows are used alone.

During the first call to the /authorize endpoint of the authorization server, a client application can specify the following values for the response_type parameter, making the authorization server behave differently:

• code token: When specified in the HTTP request, an access token and an authorization code must be included in a successful response
• code id_token: When specified in the HTTP request, an authorization code and an ID token must be included in a successful response
• id_token token: When specified in the HTTP request, an ID token and an access token must be included in a successful response
• code id_token token: When specified in the HTTP request, an access token and an ID token must be included in a successful response
...