Why OAuth Uses an Authorization Code Instead of Just Handing Over the Token

Every time you click 'Sign in with Google' on a third-party app, a two-step dance happens behind the scenes. The Google OAuth server returns a short-lived authorization code and the third-party server