What is OAuth 2.0?
OAuth 2.0 is an authorization framework that allows a user to grant a third-party application limited access to their resources on another service without revealing their password.
OAuth 2.0 is an authorization framework defined in RFC 6749. It enables a user (the resource owner) to delegate scoped access to a client application (a third-party app or website) to act on their behalf at a resource server (the service holding the user's data), without requiring the client to handle the user's credentials. This is the core idea of delegated authorization: the user authenticates directly with the authorization server, which then issues a token to the client.
The framework operates through a series of authorized grant types, each tailored to a different client scenario. The authorization code grant is the most common and secure for server-side web applications: the client first obtains an authorization code after the user approves access, then exchanges that code (along with a client secret) for an access token. The implicit grant (now deprecated for browser-based apps) returned the token directly in the URL fragment. The client credentials grant is used when the client itself is the resource owner (for machine-to-machine communication). The resource owner password credentials grant allows the client to directly exchange the user's username and password for a token, but this is discouraged because it exposes the password to the client. The device authorization grant (RFC 8628) is designed for devices with limited input (e.g., smart TVs).
Access tokens (often JSON Web Tokens or opaque bearer tokens) carry scope and expiration information. The client presents the access token to the resource server to access protected resources. Refresh tokens (long-lived) can be used to obtain new access tokens without re-authentication. OAuth 2.0 is not an authentication protocol; it is strictly for authorization. OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that adds authentication. OAuth 2.0 is widely used by APIs from Google, Facebook, GitHub, and Microsoft to secure their endpoints.
Key facts
- Standardized in RFC 6749 and RFC 6750 (bearer token usage).
- Defines four main grant types: authorization code, implicit (deprecated), client credentials, and resource owner password credentials.
- Access tokens are opaque or structured (e.g., JWT) and have a scope and expiration.
- Refresh tokens allow obtaining new access tokens without user interaction.
- OAuth 2.0 provides authorization only; authentication requires OpenID Connect.
- The implicit grant is no longer recommended for browser apps due to security risks (see RFC 9700).
How it works in practice
Related terms
References
More in Security
2FA
Two-factor authentication (2FA) is a security method that requires a user to present two distinct types of evidence to verify their identity, typically a password and a time-based one-time code from an authenticator app or hardware key.
Bot Management
Bot management detects automated web traffic and distinguishes it from human users, using behavioral fingerprinting and other signals to block malicious bots while allowing benign ones.
Credential Stuffing
Credential stuffing is a cyberattack in which automated tools use username-password pairs leaked from one site to try logging into other sites, exploiting password reuse.
DDoS
A DDoS (Distributed Denial of Service) attack overwhelms a target server, service, or network with massive traffic from many compromised computers, making it unavailable to legitimate users.
DDoS Scrubbing
DDoS scrubbing diverts attack traffic to a specialized filtering facility that removes malicious packets and forwards only legitimate traffic to the target network.
Firewall
A network security device or software that monitors and controls incoming and outgoing traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks.
IDS
An Intrusion Detection System (IDS) monitors network traffic or host activity for signs of malicious behavior or policy violations and generates alerts for security personnel.
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic inline and actively blocks malicious packets before they reach their target.
OpenID Connect
OpenID Connect (OIDC) is an identity authentication layer built on OAuth 2.0 that provides a signed ID token containing verified user identity claims.
Passkey
A passkey is a FIDO2/WebAuthn credential stored on a user's device that replaces passwords with public-key cryptography for authentication.