The explicit flow approach is the most commonly used in server-side web applications for a number of good reasons: the auth source code is not publicly exposed, the client SecretC confidentiality can be maintained, and the whole process is definitely more secure due to the presence of the authorization code, that is nothing less than an additional security layer.

On top of that, in our given scenario, we can rely on an excellent server-side tool--the Microsoft.AspNetCore.Identity service--which natively supports a wide bunch of external providers, including Facebook, Google, Twitter, and so on. All we need to do is implement a couple of action methods in our existing TokenController.

The only real downside about that is the fact that it is still a flow based upon browser redirection, which means that the application must be capable of interacting with the user agent (also known as the web browser); open the login/auth pop-up (with a proper size), receive API authorization codes that are routed through the browser, close that pop-up, and so on. Although this is hardly an issue in standard MVC web applications, it's definitely way more complicated when dealing with Angular and single-page applications; although it can be definitely forced into that, the developer will eventually have to pull off a small, yet consistent number of nasty workarounds; it won't be an out-of-the-box experience, that's for sure.