OAuth 2.0
What it is
OAuth 2.0 (RFC 6749) is the authorization framework behind "Sign in with..." and "Connect your account" buttons. It lets a user grant an application limited, scoped access to their resources at another service without sharing a password. Crucially, OAuth is about authorization, not authentication: it answers "what may this app do," not "who is this user." Using an access token as proof of login is the classic OAuth mistake, which is what OpenID Connect exists to fix.
How it works
The core actors are the resource owner (user), the client (app), the authorization server, and the resource server (API). The client redirects the user to the authorization server, the user consents, and the client receives an access token (and often a refresh token) it presents to the API.
- Access token: a short-lived credential scoped to specific permissions.
- Refresh token: exchanged for new access tokens without re-prompting the user.
- Scopes: the permissions being requested, such as
read:calendar. - Grants (flows): the authorization code flow with PKCE for user-facing apps, and the client credentials grant for machine-to-machine.
Status
RFC 6749 dates to 2012 and is universally deployed. The IETF published the OAuth 2.0 Security Best Current Practice as RFC 9700 in 2025, and OAuth 2.1 consolidates that guidance into one specification.
Pitfalls
- Treating an access token as authentication. Use OpenID Connect for login.
- The implicit and resource-owner-password grants are discouraged; do not use them in new builds.
- Always use PKCE, validate redirect URIs strictly, and keep tokens short-lived.
Related
Glossary: OAuth, scopes and claims, token exchange. Guide: OAuth vs OIDC and the implementation guide.
Who wrote it
RFC 6749 was edited by Dick Hardt. The security guidance that hardened it since is largely the work of Torsten Lodderstedt and Daniel Fett, and Aaron Parecki maintains the documentation most developers learn it from. Hannes Tschofenig co-chaired the IETF working group that produced it. More in the experts directory.
Related on Start with Identity
- BlogConsentFix: hijacking Microsoft 365 through the OAuth consent flow
ConsentFix adapts the ClickFix pattern to identity. Instead of running a command on the victim's machine, it walks them through an OAuth consent flow and asks t
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEF5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-day
BIG-IP APM configured as an OAuth authorization server had a heap overflow that unauthenticated traffic could turn into remote code execution. CVSS 9.8, exploit
- RecipeImplement OAuth authorization code flow with PKCE
A step-by-step, framework-agnostic implementation of the OAuth 2.0/2.1 authorization code flow with PKCE: generating the verifier and challenge, building the au
- ArticleLearn Identity by Ear: Podcast Episodes on OAuth, OIDC, SAML and Passkeys
A listening plan for people new to identity: 14 podcast episodes, in order, that teach OAuth, OpenID Connect, SAML and passkeys from the people who wrote the sp