Follow One OAuth Token From Birth to Expiry, and Most Interview Questions Answer Themselves

Why does the authorization server hand your app a code, and not the token it actually wants? If you can answer that in two sentences, you can answer about half of the OAuth questions an interviewer wi