Não decore palavra por palavra: entenda a estrutura da resposta e refaça com as suas palavras, em inglês.
A framework for delegated authorization. In the authorization-code flow, the client redirects the user to an authorization server, receives a code, and exchanges it for tokens. Other OAuth flows serve different situations, such as service-to-service access.
Use PKCE for the code flow, validate redirect URIs, and bind the response to the initiating session to prevent request substitution. A browser application cannot keep a client secret confidential.
OpenID Connect adds an identity layer. For "Login with Google", validate the OIDC ID token's issuer, audience, signature, expiry, and applicable nonce. An OAuth access token is not automatically an identity assertion for your application.
Source: OAuth security best current practice.
Ler é o primeiro passo. No app, essa pergunta vira flashcard com repetição espaçada, e o módulo tem quiz e simulado para testar o que ficou.
Treinar essa pergunta no app