The code that was caught on the way back
The mobile app opens a browser, the user signs in, and the identity provider redirects back to the app carrying an authorization code. The app exchanges that code for tokens.
Another application on the same device registered the same redirect target. It gets the code first and exchanges it. Nothing about that exchange was malformed — the code was genuine, and the provider had no way to tell that the client redeeming it was not the client that asked for it.
Outside every boundary: Another app (same redirect URI; FAILED: catches the code), The app (a public client), Authorization code (valid on its own), Identity provider (the token endpoint), an empty slot for the sent with the authorization request, an empty slot for the produced only at redemption Connections: The app calls sent with the authorization request (step 1) sent with the authorization request calls Identity provider (step 2) Identity provider calls Authorization code (step 3) Authorization code calls The app — through the device (step 4) Authorization code calls Another app — intercepted The app calls produced only at redemption (step 5) produced only at redemption calls Identity provider — proves it was us (step 6) Another app must NOT reach Identity provider — no verifier