Implicit
Returned tokens directly in the authorization URL fragment. Insecure (token in URL, browser history, referrer).
Implicit
Spec: RFC 6749 §4.2 (deprecated)
Supported in Ionize: No (deprecated; do not use)
When to use
Never. Removed in OAuth 2.1. Use PKCE instead.
How it works
Returned tokens directly in the authorization URL fragment. Insecure (token in URL, browser history, referrer).
Why not
This grant is deprecated and removed in OAuth 2.1. Ionize rejects it. The replacement is Authorization Code + PKCE.
Related
Refresh Token
Client exchanges refresh token for a new access token (and a new refresh token — Hydra rotates).
Resource Owner Password Credentials
Client collected the user's password and POSTed directly to the token endpoint. The user's password is in your app — defeats the point of OAuth2 delegation.