OAuth is an authorization framework that lets an application get limited access to an HTTP service, either on behalf of a user or for itself, without the user handing over a password. OAuth 2.0 is defined in RFC 6749. When you collect data through an official API that uses OAuth, your code sends an access token with each request instead of login credentials.

Without OAuth, users would have to give third-party apps their passwords. That exposes the password, gives the app overly broad access, and makes it hard to revoke one app without changing the password for all of them. An access token instead carries a specific scope, lifetime and other access attributes.

The Four OAuth Roles

  • Resource owner: The party that can grant access to a protected resource. When this is a person, it is the end user.
  • Client: The application that requests the protected resources.
  • Authorization server: Authenticates the resource owner, gets approval and issues access tokens to the client.
  • Resource server: Hosts the protected resources and responds to requests that carry access tokens.

OAuth Grant Types

  • Authorization code: The client sends the user to the authorization server and exchanges the returned code for a token. The user's credentials never reach the client.
  • Client credentials: The client authenticates as itself to get a token, for example for resources it controls.
  • Implicit and password grants: Both appear in RFC 6749, but oauth.net now labels them as legacy flows.
  • What comes next: OAuth 2.1 is an in-progress effort to consolidate OAuth 2.0 and common extensions. OpenID Connect is a separate identity protocol built on OAuth 2.0.

Authorization, Not Authentication

OAuth 2.0 is not an authentication protocol. Authentication tells an app who the current user is and whether they are present. An OAuth access token tells the client neither of those things. OpenID Connect adds that layer: it is built directly on OAuth 2.0 and adds an ID Token that carries authentication information.

OAuth 1.0 vs. OAuth 2.0

  • Replacement: RFC 6749 (OAuth 2.0) replaces and obsoletes OAuth 1.0, which was defined in RFC 5849.
  • Not compatible: OAuth 2.0 is not backward compatible with OAuth 1.0. The two versions can coexist, and a service can support both.
  • TLS required: OAuth 2.0 requires TLS for requests to the token endpoint.