Trying to understand the OAuth2 flow
===

So, I'm implementing a Provider with OAuth2.

I get the part where the client applies for a client_id and a client_secret.  This uniquely identifies them to the provider.

So, now that they have that, and they are going over SSL, why is an authorize token needed?  And then, after that, why is an authorize code needed?

Also, why a refresh token?

Why can't we just go with the client_id and client_secret?  I do get that for resources protected based on the end user's authorization, there is needed an extra authorization.  That much makes sense.  but why an auth token AND code?

Finally, is all of this needed for resources that are not end-user protected?

So, I guess that's 5 different questions to help me understand:

    1. Why an auth token?
    2. Why an auth code?
    3. Why a refresh token?
    4. Why not just use client credentials for non-protected resources (or can we)?
    5. Why *both* an auth token and code? (I guess this may be answered by both 1 and 2).

THANKS for any help figuring this out!