There are two calls; one to the authorize endpoint returning a code and one to the token endpoint sending the code back.

So this is the authorization code grant flow; not implicit. It uses PKCE - a flow that is only available with the authorization code grant.