OAuth 2 Flow Tech Infographic with ECS Fargate Architecture Diagram

Tech architecture infographic titled "OAuth 2 Flow" using HOW-IT-WORKS archetype, designed for a non-technical executive audience. Show a clear numbered stage diagram with labeled boxes connected by directional arrows across a dark canvas. Include these main components as clean vector boxes with icons, canonical English names, and one-line role descriptions: 1) User Browser — "Starts login and receives redirect" with browser icon, 2) Client Application / Frontend — "Requests authorization and handles callback" with app window icon, 3) Authorization Server — "Authenticates user and issues authorization code / access token" with shield-server icon, 4) API Gateway / API Server — "Validates access token and serves protected REST data" with server/API icon, 5) Database — "Stores users, clients, scopes, and consent records" with database cylinder icon, 6) Cache — "Temporarily stores sessions, token metadata, or state" with cache/lightning icon, 7) Queue — "Processes async audit or notification events" with queue/message icon. Use arrows with short English labels showing what moves between components: "HTTPS authorize request", "Login credentials", "User consent", "302 redirect with authorization code", "POST /token", "Access token", "JWT bearer token", "REST API request", "JSON response", "Read user record", "Session lookup", "Audit event". Show a technically accurate OAuth 2 Authorization Code flow, simplified but correct: browser starts sign-in, client application redirects user to authorization server over HTTPS, authorization server authenticates user and may read user/client data from database and session/state from cache, authorization server returns 302 redirect with authorization code to client callback, client exchanges code for access token via back-channel HTTPS POST /token, API receives bearer token on protected request, validates token directly or via introspection metadata lookup, then reads/writes database, optionally checks cache, and emits async audit event to queue. Avoid unsupported security claims and do not frame as audited reference architecture. Include a small generic cloud boundary using neutral cloud icons only, no vendor branding. Add a numbered legend 1-7 in English: 1. User opens the app and selects Sign in. 2. Client Application sends an OAuth authorization request to the Authorization Server over HTTPS. 3. Authorization Server authenticates the user and records consent, using Database and Cache as needed. 4. Authorization Server redirects the Browser back with an authorization code using HTTP 302. 5. Client Application sends POST /token to exchange the code for an access token. 6. Browser or Client calls the API with a Bearer access token; API validates the token and loads protected data. 7. API returns a JSON response and may send an audit event to the Queue. Visual style: editorial developer-blog illustration, isometric or flat tech-diagram style, vector-clean infographic layout. Dark-mode developer aesthetic, dark graphite background, neon cyan, electric blue, violet, and magenta accents, soft glow edges, crisp grid alignment, high contrast, executive-friendly spacing, minimal clutter, polished modern UI-diagram mood. All text MUST be written in English (array). Every heading, label, caption, legend and metric name in the image must be in English — not English. Spell each English word correctly using English characters and diacritics. Numbers stay as digits, no real cloud-vendor logos (AWS / GCP / Azure) — use generic cloud icons, no watermarks No real cloud-vendor logos (AWS, GCP, Azure) beyond generic cloud icons. Common protocol names (HTTPS, TCP, JWT, OAuth, REST, GraphQL) stay in canonical English form. No security-claim overstatements (do not present diagrams as audited reference architectures).