What are the OAuth 2.0 grant types and when do you use each?

OAuth 2.0 has four main grant types. Authorization Code: the user authorizes via a browser redirect, the server returns an authorization code, which the backend exchanges for tokens. Safest — tokens never exposed to the browser. Authorization Code + PKCE (Proof Key for Code Exchange): same as above but for public clients (SPAs, mobile apps) that cannot keep a client secret — PKCE prevents code interception attacks. Now recommended for all clients. Client Credentials: machine-to-machine authentication where there is no user — the client authenticates directly with client_id and client_secret to get an access token. Used for backend services and cron jobs. Implicit (deprecated): returned tokens directly to the browser — now replaced by Authorization Code + PKCE. Avoid implicit flow in new implementations.