What is OAuth 2.0 and how does it work?

Question

ICSM Computer · Answer

OAuth 2.0 is an industry-standard authorization framework that allows third-party applications to access user data
without exposing user credentials (like passwords).
What Is OAuth 2.0?
It’s not authentication (though often misused that way) — it’s for
granting access to resources.
OAuth allows a user to authorize one application to access their data (e.g., profile, files) on another service
securely and in a controlled manner.
Real-World Analogy
It's like giving someone a hotel keycard (token) that opens 
only one door, only during your stay, instead of giving them your
master key (password).
OAuth 2.0 Key Roles
Role
Description
Resource Owner
The user who owns the data (e.g., you).
Client
The app requesting access (e.g., Instagram).
Authorization Server
Issues tokens (e.g., Google Auth server).
Resource Server
Hosts the data (e.g., Google Drive API).
How OAuth 2.0 Works (Authorization Code Flow – Most Common)
Step-by-Step
Client Redirects User to Authorization Server
https://authserver.com/auth?client_id=abcandredirect_uri=...andresponse_type=codeandscope=read
User Logs In and Approves Access
The user logs in to the authorization server and grants permission.
Authorization Server Sends Back a Code
Redirects back to client app:
https://yourapp.com/callback?code=xyz123
Client Exchanges Code for Access Token
Backend server sends a POST request with:
client IDclient secretauth coderedirect URI
Response:
{
  "access_token": "abc123token",
  "refresh_token": "xyz789",
  "expires_in": 3600
}
Client Uses Access Token to Call API
Adds header:
Authorization: Bearer abc123token
Access Token Expires
Use refresh_token to get a new one without prompting user again.
and 
Grant Types (Flows)
Grant Type
Use Case
Authorization Code
Most secure. Used by web apps, SPAs (with PKCE).
Client Credentials
Machine-to-machine communication (no user).
Implicit
Legacy for SPAs (now discouraged due to security).
Password Grant
Direct username/password (discouraged).
Device Code
For devices without a browser (e.g., smart TVs).
Benefits of OAuth 2.0
Secure Delegation: Apps don’t get user passwords.Token Expiry: Reduces risk of long-term compromise.Fine-Grained Scopes: Control what an app can access.Standardized: Widely adopted (Google, Facebook, GitHub, etc.).
Common Misconception
OAuth 2.0 is not authentication — it's about delegated access.
To authenticate a user, use OpenID Connect (OIDC), which builds on OAuth 2.0.
and

interview

What is OAuth 2.0 and how does it work?

ICSM Computer

Can you answer this question?

1 Answers

What Is OAuth 2.0?

Real-World Analogy

OAuth 2.0 Key Roles

How OAuth 2.0 Works (Authorization Code Flow – Most Common)

Step-by-Step

Grant Types (Flows)

Benefits of OAuth 2.0

Common Misconception

Liked By

Role	Description
Resource Owner	The user who owns the data (e.g., you).
Client	The app requesting access (e.g., Instagram).
Authorization Server	Issues tokens (e.g., Google Auth server).
Resource Server	Hosts the data (e.g., Google Drive API).

Grant Type	Use Case
Authorization Code	Most secure. Used by web apps, SPAs (with PKCE).
Client Credentials	Machine-to-machine communication (no user).
Implicit	Legacy for SPAs (now discouraged due to security).
Password Grant	Direct username/password (discouraged).
Device Code	For devices without a browser (e.g., smart TVs).