Salesforce Oauth Token for Public apps

Question

How the Workbench and other Public apps get access token for salesforce Even we didn't create any Connected App for that and Even for Sign in they redirect to standard salesforce login Page.I checked the Digging Deeper into OAuth 2.0 in Salesforce but did't Understand What is the flow.Is it something like when we login using the link provided on these sites they specified a callback url to there site and thus they get access token.But what when we are already login in an environment and when we click on the login page it gets the access token for that environment.Any article or documentation Like how to connect apps with salesforce without making an entry in connected app?

Answer 1

They do have connected apps. That's why, when you authenticate to Workbench from a new account, you need to approve its access:

The Connected App is providing the name and branding of the application here.

Connected Apps are in a sense global metadata. They don't need to exist in your org for you to be able to approve OAuth access for them. They just need to exist in some org, like the org of the app's creator.

Is it something like when we login using the link provided on these sites they specified a callback url to there site and thus they get access token

Yes, that's accurate at a summary level. Workbench implements the Web Server OAuth Flow. It's open source, so you can check out how they do it (in PHP) on their GitHub.