OAuth 2.0

OAuth 2.0 is an authorization framework for delegated access to HTTP services. It lets a client obtain limited access to a protected resource without receiving the resource owner's password. An authorization server issues an access token after it evaluates a grant. The client presents that token to a resource server.

The most useful mental model is separate approval, token issuance, and API access:

resource owner → authorization server → client → resource server
     approves       issues token       presents token     serves data

OAuth defines how those parties exchange authorization. It does not define user identity, application permissions, or the internal format of every token. OpenID Connect adds an identity layer when a client needs authentication information about a user.

The four roles

The resource owner can grant access to a protected resource. A person is one common resource owner, but a workload can own resources too.
The client requests access and calls the protected API. The word does not imply a browser, mobile app, or server.
The authorization server authenticates the resource owner when needed, obtains authorization, and issues tokens.
The resource server hosts the protected resource and accepts valid access tokens.

One authorization server can issue tokens for several resource servers. The authorization server and resource server can also be operated together. OAuth leaves that deployment boundary open.

OAuth 2.0

The four roles

Relevant careers