I'd like to understand OAuth 2.0 in more detail and especially the authorization code flow. This might be nit-picking but according to RFC6749 the client initiates the flow.
(A) The client initiates the flow by directing the resource owner's user-agent to the authorization endpoint.
But isn't it really the resource owner who initiates the flow by clicking a button like
Connect with service xyz or
Import photos from abc on the client application site when requesting authorization?
I mean it's this button click that sends out a HTTP GET originating from the resource owners machine/IP, right?