DataTerminology.comNEW
Also known as: OAuth2
An authorization framework enabling applications to obtain scoped, delegated access to HTTP services via tokens.
DESCRIPTION
OAuth 2.0 standardizes delegated authorization using access tokens issued by authorization servers. It supports multiple grants (authorization code, client credentials, device code) and extensions like PKCE. Tokens carry scopes defining permitted actions. OAuth underpins API security across cloud services and consumer apps. Proper token handling, consent, and refresh logic are essential for secure implementations.
ALTERNATIVE DEFINITIONS
IETF RFC 6749
The OAuth 2.0 Authorization Framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.
Authoritative specification describing delegated authorization and flows.
Google Developers
OAuth 2.0 is the industry-standard protocol for authorization.
Concise positioning of OAuth 2.0 as the industry standard.
Wikipedia
OAuth is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites without giving them the passwords.
Explains access delegation for consumer scenarios.
RELATED TERMS
OpenID Connect Authorization Server Bearer Token Access Token Refresh Token Client Credentials PKCE Scope Consent
COMPETING TERMS
OAuth 1.0a SAML 2.0
RELATIONS
- Implemented by: API Gateway API Integration
KNOWLEDGE AREAS
Data Security Software Engineering Cloud Platform & Tooling
TARGET AUDIENCE
Software Developer DevOps Engineer Cloud Architect Data Engineer Chief Information Officer Chief Technology Officer AI Engineer
EXTERNAL SOURCES
- Wikipedia - OAuth
- IETF - Core OAuth 2.0 specification
- OAuth.net - Community resource and guides
- Auth0 - OAuth protocol developer docs
TOP QUESTIONS
What problem does OAuth 2.0 solve?
It enables delegated authorization so applications access resources without sharing user credentials, using tokens with limited scope.
Category: Topic
Which OAuth 2.0 grant should I use?
Use authorization code with PKCE for user-based web/mobile flows, client credentials for service-to-service, and device code for limited-input devices.
Category: Requirements
How is OAuth 2.0 related to OpenID Connect?
OIDC adds an identity layer for authentication on top of OAuth’s authorization framework.
Category: Alternatives
What are common OAuth 2.0 mistakes?
Skipping PKCE, mismanaging refresh tokens, and storing tokens insecurely can lead to compromise.
Category: Mistakes
What is the role of scopes in OAuth 2.0?
Scopes define permitted actions, allowing fine-grained, consented access to resources.
Category: Example
Is OAuth 2.0 secure by default?
Security depends on correct flow selection, HTTPS enforcement, and robust token management.
Category: Opinion
How do you validate OAuth 2.0 tokens?
Validate signatures, issuers, audiences, expiration, and scopes; use JWKS for signing keys.
Category: Management
What is PKCE and why use it with OAuth 2.0?
PKCE mitigates authorization code interception for public clients by binding authorization requests to code verifiers.
Category: Requirements
How does OAuth 2.0 compare to SAML 2.0?
SAML focuses on federation via assertions; OAuth is optimized for API authorization and mobile/web flows.
Category: Alternatives