OAuth

OAuth (Open Authorization) is an authorization framework that allows users to grant applications limited access to resources on another service without sharing their passwords.

OAuth is widely used in web applications, APIs, and cloud services to manage secure access to user data.

Also known as: OAuth 2.0, delegated authorization framework.

How Does OAuth Work?

OAuth uses access tokens to authorize applications to access protected resources.

A typical OAuth 2.0 authorization code flow includes:

1. A user connects an application to an external service.
2. The application redirects the user to the service's authorization page.
3. The user signs in and approves the requested permissions.
4. The application receives an authorization code.
5. The application exchanges the code for an access token.
6. The application uses the token to access permitted resources.

The application does not need to receive the user's password.

Key OAuth Components

• Resource Owner: The user or entity that controls the protected resources.
• Client: The application requesting access.
• Authorization Server: Issues access tokens after authorization.
• Resource Server: Hosts the protected data or services.
• Access Token: Allows access to approved resources.
• Refresh Token: Can be used to obtain a new access token when permitted.

OAuth vs. API Key

OAuth and API keys both support API access, but they work differently.

• OAuth: Uses delegated authorization and can provide limited permissions through scoped, time-limited tokens.
• API Key: Uses a credential issued to identify or authorize an application or caller.

OAuth is particularly useful when applications need permission to access resources belonging to individual users.

OAuth vs. OpenID Connect

OAuth focuses on authorization, while OpenID Connect (OIDC) adds standardized authentication capabilities.

In simple terms:

• OAuth: Determines what an application is allowed to access.
• OpenID Connect: Helps applications verify a user's identity.

OpenID Connect is commonly used for social login and single sign-on.

Advantages of OAuth

• Improved security: Applications do not need users' passwords.
• Limited permissions: Access tokens can restrict which resources an application may use.
• Revocable access: Users or service providers can withdraw authorization.
• Broad compatibility: Supported by many major APIs and online services.

Limitations of OAuth

• Implementation complexity: Authorization flows require careful configuration.
• Token security: Stolen access tokens may be misused until they expire or are revoked.
• Token management: Applications must handle expiration and refresh securely.
• Configuration risks: Incorrect redirect URI or permission settings can introduce vulnerabilities.

OAuth and Web APIs

OAuth 2.0 is commonly used to protect APIs that handle user accounts or sensitive resources.

For example, an application may request permission to read a user's calendar without gaining access to unrelated account information.

After authorization, the application can send an access token in an HTTP request:

GET /calendar/events HTTP/1.1
Authorization: Bearer ACCESS_TOKEN

The API validates the token and determines whether the requested operation is permitted.

Example

Suppose a productivity application wants to access a user's cloud calendar.

The application redirects the user to the calendar provider's authorization page. After signing in, the user approves read-only calendar access.

The application receives an access token and uses it to retrieve calendar events.

The user can later revoke that permission without changing their account password.

Key Takeaway

OAuth is an authorization framework that enables applications to access protected resources with user-approved permissions instead of shared passwords.

It uses tokens and authorization flows to support secure, limited API access. OAuth is widely used in modern web services, while OpenID Connect extends OAuth 2.0 for user authentication.