OAuth

OAuth (Open Authorization) is an open authorization standard that lets an application obtain limited access to a user's data stored in another service — without having to share that service's login and password. It is the mechanism behind "Sign in with Google" and "Connect with Facebook" buttons, as well as integrations between applications that use APIs.

How OAuth works

The idea behind OAuth is to separate access to resources from the user's credentials. Instead of entering a password in a third-party app, the user logs in directly with the service provider (the authorization server) and consents to a specific, limited set of permissions. In return, the app receives an access token — a temporary key it uses to prove its permissions on every request to an API. Tokens often take the JWT format.

The OAuth 2.0 standard defines several scenarios (grants) tailored to different situations: Authorization Code for web applications, Client Credentials for server-to-server communication, and Device Flow for devices without a browser. Key concepts include the scope, which defines what a token grants access to, and the refresh token, which lets an app obtain a new access token without logging in again.

Practical application

OAuth is the foundation of modern integrations: social sign-on (SSO), mobile apps connecting to a backend, and services that access another platform's data on a user's behalf — for example a publishing tool gaining access to a social media account. The key benefit is security: the password never reaches the third-party app, and granted access can be revoked at any moment.

It is worth distinguishing OAuth from authentication. OAuth itself answers "what is the app allowed to do", not "who is the user" — identity confirmation is handled by the OpenID Connect layer built on top of it. OAuth also complements other security mechanisms, such as two-factor authentication, together forming a coherent access-control model in REST-based architectures.