OAuth

OAuth 2.0 is an authorization framework that lets third-party applications access a user's resources with the user's consent, without sharing passwords, by using tokens.

Purpose

It implements delegated authorization: an application can access the user's resources on another service without ever seeing the password.

Mechanism

Flow: the client requests authorization from the authorization server → the user grants it → the client receives an authorization code → exchanges it for an access_token → uses the token against the resource server. Grant types: authorization_code, implicit, password, client_credentials, and refresh_token.

Use cases

Third-party login (Sign in with Google)
Authorized API access
Cross-service SSO
Mobile authorization

Examples

Input

authorization code → access_token

Output

Call the API with the token

The authorization code flow

Common errors

The implicit flow exposes the token to the browser: Use authorization_code with PKCE

Related terms

OpenID Connect (OIDC) is an identity layer on top of OAuth 2.0 that provides user authentication and identity information, and it is the de facto standard for SSO.

JWT (JSON Web Token) is a compact, self-contained token that securely conveys claims as a JSON object, widely used for stateless authentication and information exchange.

A Bearer token is a token type that works purely by possession: it is sent in the Authorization: Bearer <token> header, so whoever holds it can use it, with no additional credentials.

A cookie is a key-value pair set by the server and stored by the browser, sent automatically with same-origin requests for session and state management.

Related tools

Oauth Token Parser

Oauth Token Parser — pure client-side tool. Privacy-first, no server round-trip.

References