The Authorization Code flow is the most secure OAuth pattern for server-side apps:
User clicks "Login with Provider"
Your app redirects to authorization server
User authenticates and grants consent
Server redirects back with authorization code
Your backend exchanges code for tokens
Backend receives access token and refresh token
The code-to-token exchange happens server-side, so tokens never touch the browser. This prevents token theft through browser history or logs.