Tech

OAuth 2.0

Definition

An authorization framework that enables third-party applications to obtain limited access to a user's resources on another service without exposing the user's credentials.

Try the free calculator

Use our JWT Decoder to run the numbers yourself.

OAuth 2.0 is the industry-standard protocol for authorization, allowing users to grant third-party applications access to their resources on a service provider without sharing their passwords. When you click Sign in with Google on a website, OAuth 2.0 is the protocol enabling that interaction. The user authenticates directly with Google and authorizes the application to access specific information.

The OAuth 2.0 flow involves several parties: the resource owner (user), the client application requesting access, the authorization server that authenticates the user and issues tokens, and the resource server that hosts the protected resources. The most common flow for web applications is the Authorization Code Grant, where the user is redirected to the authorization server, approves the request, and the client receives a short-lived authorization code that is exchanged for access and refresh tokens.

OAuth 2.0 scopes define the specific permissions being requested, such as read-only access to a user's email or write access to their calendar. Security best practices include using PKCE (Proof Key for Code Exchange) to prevent authorization code interception attacks, storing tokens securely, implementing token rotation, and requesting only the minimum scopes necessary for the application's functionality.

Get weekly tips for OAuth 2.0 & more

No spam. Unsubscribe anytime.

Related Calculators

Related Terms

Related Articles

Stay Updated

Get notified about new tools, features, and exclusive deals. No spam, ever.