In both Authorization Code and Credentials Flow for Customers and Partners and OAuth 2.0 Username-Password Flow user's Salesforce username-password is exchanged by the Third-party app with Salesforce Authorization server to obtain the access token.
In fact the Auth Code and Cred Flow passes the user's username password over browser call to obtain the auth code . Whereas , in Username-Password flow there is a possibility to do this exchange from the Third-Party app's backend-server to obtain the access token.
a. If the above is true , then is "Authorization Code and Credentials Flow for Customers and Partners" more / less / same secure compared to "OAuth 2.0 Username-Password Flow" ?
b. If more then how ?
c. If Less/same , then what should be most secure way to implement "headless login" for a Third-party app (client ) with Salesforce ( the resource server ) ?
Authorization code flow with PKCE can be even more secure
