The implicit grant type does not require client authentication, and relies on the presence of the resource owner and the registration of the redirection URI. The resource owner needs to authenticate with the authorization server to obtain the access token. Because the access token is encoded into the redirection URI, it may be exposed to the resource owner and other applications residing in the same device.
The diagram below depicts the flow of Implicit Grant.
The client requests for the access token with the client ID and grant type with optional parameters.
Since the resource owner authenticates directly with the authorization server, his/her credentials will not be shared with the client.
The Authorization Server sends the Access token in URI fragment to the client.
Client extract the token from the fragment and send the API request to the Resource Server with the access token.
With this grant, the refresh token will not be issued for the client as the client type is public.