OAuth 2.0 Reference
Reference 为 OAuth 2.0 框架: grant types, flows, tokens, 和 scopes.
Grant Types
Authorization Code (with PKCE) is the standard flow for web and mobile apps. Client Credentials is for machine-to-machine (no user). Refresh Token obtains new access tokens. Resource Owner Password Credentials is deprecated (legacy only). Implicit is deprecated (use Authorization Code + PKCE). Device Code is for devices without a browser (TVs, CLI). PKCE (Proof Key for Code Exchange) prevents authorization code interception on mobile/SPAs.
- auth code
- Standard flow
- client creds
- Machine-to-machine
- PKCE
- Code interception prevention
with PKCEno usermobile/SPATokens and Scopes
Access tokens authorize API calls; they should be short-lived (minutes). Refresh tokens obtain new access tokens; they are long-lived (days/weeks) and must be stored securely. Scopes limit what a token can do (read, write, admin). Scopes are defined by the authorization server and enforced by resource servers. Token revocation endpoints invalidate compromised tokens. The token introspection endpoint (RFC 7662) validates opaque tokens. Bearer tokens are sent in the Authorization header.
- access token
- Short-lived
- refresh token
- Long-lived
- scopes
- Permission grants
minutessecure storageread, write