Auth
OAuth 2.0
A delegated authorization standard: an app gets limited access to a user's resources without their password.
What it is
OAuth 2.0 answers "what is this app allowed to do". The user confirms access with a trusted provider, and the app gets an access token with limited rights (scopes).
There are several flows (grant types). For web and mobile apps Authorization Code with PKCE is recommended today, for server-to-server Client Credentials. Implicit and Password are considered obsolete.
OAuth 2.0 is about authorization, not authentication. To learn who the user is, OpenID Connect is added on top.
Use it when
- Letting third-party apps access your API without sharing a password.
- Sign in with Google, GitHub and other providers (together with OIDC).
- Service-to-service authorization with limited rights.
Avoid it when
- A single internal app with one login: cookie sessions are simpler.
- As the only user authentication mechanism: use OIDC.
Key concepts
- Roles
- Resource owner, client, authorization server, resource server.
- Access / refresh token
- A short-lived access token and a long-lived one to renew it.
- Scope
- A list of allowed actions, like
read:profile. - PKCE
- Protects the authorization code from interception in public clients.
Example
Interview questions
1. How does OAuth 2.0 differ from authentication?
OAuth issues a token with rights to resources but does not say who the user is. OpenID Connect adds authentication through the ID token.
2. Why PKCE?
Public clients (SPAs, mobile) cannot keep a secret. PKCE binds the authorization code to a one-time
code_verifier, so an intercepted code is useless.3. What is a refresh token for?
Access tokens are short-lived. A refresh token gets a new one without logging in again, and it must be stored carefully and rotated.
Related technologies
- OpenID ConnectAn authentication layer on top of OAuth 2.0: the client receives an ID token with user information.
- JWTA compact signed token in JSON format that carries claims about a user or permissions.
- KeycloakAn open source identity and access management solution with SSO, OIDC, SAML and roles.
- Auth0A managed authentication and authorization service: sign-in, SSO, MFA and API access with no identity server of your own.
- PasskeysPasswordless sign-in on public keys: the private key stays on the device and biometrics or a PIN confirm it.
Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).