Tokens never travel through the URL. Current guidance recommends it, with PKCE, for all clients.
Authorization Code flow
The OAuth2 flow where the browser carries only a short-lived code and the client swaps it for tokens on a back channel.
Tokens never travel through the URL. Current guidance recommends it, with PKCE, for all clients.