# chooseFlow

**Kind:** Function

**Source:** [`atloria-monorepo/packages/ui-core/src/components/api-explorer/oauth2.ts`](https://github.com/sherkety/atloria/blob/main/atloria-monorepo/packages/ui-core/src/components/api-explorer/oauth2.ts#L141)

Pick the flow to run, or state why none can be.

Authorization code wins whenever it is offered. Implicit runs ONLY when the spec declares
nothing else: it returns the token in the URL fragment, where it lands in the address bar and
can leak through history or a referrer, and OAuth 2.1 drops it outright — so it is a last
resort for an API that offers no alternative, never a shortcut past a code exchange.

## Signature

```ts
function chooseFlow(flows: OAuth2Flows | undefined): {
  kind: OAuth2FlowKind | null;
  refusal?: OAuth2Refusal;
}
```

## Parameters

| Name | Type |
|---|---|
| `flows` | `OAuth2Flows | undefined` |

**Returns:** `{
  kind: OAuth2FlowKind | null;
  refusal?: OAuth2Refusal;
}`