Which of these is NOT a grant type in OAuth 2?

• A. Authorization Code
• B. Client Credentials
• C. Session Tokens
• D. Refresh Token

Answer: (C)

In OAuth 2, multiple grant types are defined to facilitate different scenarios for authorization and authentication, and among the given choices, "Session Tokens" is not one of the recognized grant types.

Authorization Code, Client Credentials, and Refresh Token are all established OAuth 2 grant types used for obtaining access tokens in various contexts. The Authorization Code grant is typically used for web applications where authorization is performed through a user-agent, such as a web browser. The Client Credentials grant is utilized for service-to-service communication, where a client application needs to authenticate without user intervention. The Refresh Token grant allows an application to obtain new access tokens using a previously issued refresh token, enhancing the application's ability to remain authorized without requiring the user to re-authenticate.

On the other hand, "Session Tokens" refer to a mechanism used in some authentication systems to maintain a user’s session but are not part of the OAuth 2 framework, which focuses more on the process of obtaining and using access tokens rather than managing user sessions directly. This distinction clarifies why the correct answer highlights "Session Tokens" as not being a grant type in OAuth 2.