Why does the Authorization Code grant use an intermediate 'code' instead of returning the access token directly?

The code is passed back to the client through the browser's redirect URL, which can end up in browser history, server logs, or leaked via referrer headers — exposing a powerful access token this way would be risky. The short-lived, single-use code is instead exchanged for the actual token through a direct backend-to-backend call (using the confidential client_secret), a channel the browser and its logs never see.