What Is OAuth?
What OAuth Does
What is OAuth? OAuth 2.0 is an authorization framework that lets an application obtain limited access to a user's account on another service without learning the user's password. The user approves what the application may do, and the service issues the application a token to use in its API calls.
A familiar example is an app that wants to read a user's calendar from a cloud provider. Without OAuth, the user would have to type their password into the app, which would then have full access to the account. With OAuth, the user signs in at the provider, reviews a consent screen listing the permissions requested, and the app receives a token limited to those permissions. Unlike a fixed API key, this token can be withdrawn without changing the app's own secret.
Roles, Tokens and Scopes
OAuth describes four roles. The resource owner is usually the user who owns the data. The client is the application requesting access. The authorization server authenticates the user and issues tokens. The resource server hosts the protected data and checks each token before responding.
The main tokens are an access token, which the client sends with each API request and which expires after a short time, and a refresh token, which lets the client obtain a new access token without asking the user again. Access tokens are often JWTs, although the format is up to the provider. Scopes describe what a token may do, such as reading calendar events but not creating them.
Common OAuth Authorization Flows
OAuth defines several ways to obtain tokens, called flows or grant types. The authorization code flow is the standard choice for web and mobile apps: the client receives a short-lived code through a browser redirect and exchanges it for tokens in a server-to-server request. Apps that cannot keep a secret use an extension called PKCE (Proof Key for Code Exchange), which protects that exchange. The client credentials flow covers cases with no user involved, such as one server calling another.
Older flows, such as the implicit flow, are no longer recommended for new applications. Most developers pick a flow through their framework or library, but understanding the roles helps when reading provider documentation.
OAuth, OpenID Connect and Single Sign-On
OAuth is about authorization, not proof of identity. OpenID Connect is a layer built on top of OAuth 2.0 that adds an ID token, so an application can confirm who signed in. This is why OpenID Connect is often used for login.
Single sign-on (SSO) means a user signs in once and can then access several applications without signing in again. SSO is a user experience built on identity standards, commonly OpenID Connect or SAML. Keeping the ideas apart helps: OAuth controls what an app may access, while OpenID Connect and SSO establish who the user is. For the wider set of options, see API authentication methods.
Frequently asked questions
Is OAuth the same as authentication?
Not exactly. OAuth 2.0 is designed for authorization, meaning it grants an application limited access to resources. It does not standardize how to prove a user's identity. OpenID Connect adds that identity layer when an application needs to know who signed in.
What is the difference between an access token and a refresh token?
An access token is sent with API requests and is short-lived, so a leaked one stops working quickly. A refresh token is kept by the client and used to obtain new access tokens, so it must be stored more carefully. The authorization server can usually revoke refresh tokens.