In the three-legged OAuth2 process, after the authorization server presents a form to the resource...

"If the resource owner grants access, the authorization server redirects the user's browser back to the client using the redirection URI provided earlier (in the request or during client (registration). The redirection URI includes an authorization code and any local state provided by the client earlier" "Assuming the resource owner grants access, the authorization server redirects the user-agent back to the client using the redirection URI provided earlier (in the request or during client (registration). The redirection URI includes an authorization code and any local state provided by the client earlier."