Fictional local/native-client flow. No provider was registered. No token was issued.

Resource owner: Ada
Client: notes-printer, running on the same machine
Authorization server: club-auth
Resource server: the notes app
Scope: notes.read
Registered redirect: http://127.0.0.1:8000/callback
A different path is not the registered redirect.

The owner approves notes.read at club-auth.
The client receives a code, then a token, from club-auth.
The notes app sees the token, not Ada's password.
state is a one-time value bound to the browser that started this flow.
PKCE binds code redemption to a secret verifier created by this client for this flow.
RFC 9700 says public clients must use PKCE, and says the resource-owner password grant must not be used. This card uses neither that grant nor the implicit grant.