OpenID Connect - Implicit Flow

The Implicit flow was designed for public Single-Page Applications without a back-end, before PKCE existed. It returns the ID token (and optionally an access token) directly to the client application in the fragment of the redirect URI (response_mode=fragment) or via an HTML form that auto-submits via an HTTP POST to the client's redirect URI (response_mode=form_post).

While modern guidance recommends Authorization Code with PKCE, when used with Form Post response mode, Implicit Flow offers a simplified workflow if the application only needs an ID token to authenticate the user.

This diagram shows the Implicit flow with Form Post response mode.