---
title: "What is OAuth 2.0 and how does it work?"  
description: "What is OAuth 2.0 and how does it work?"  
author: "ICSM Computer"  
published: 2025-06-05  
updated: 2025-06-05  
canonical: https://www.mindstick.com/interview/34214/what-is-oauth-2-0-and-how-does-it-work  
category: "api(s)"  
tags: ["api(s)", "authentication", "authorization"]  
reading_time: 5 minutes  

---

# What is OAuth 2.0 and how does it work?

**OAuth 2.0** is an industry-standard **authorization framework** that allows third-party applications to access user data **without exposing user credentials** (like passwords).

## What Is OAuth 2.0?

It’s **not authentication** (though often misused that way) — it’s for **granting access to resources**.

OAuth allows a user to **authorize** one application to access their data (e.g., profile, files) on another service **securely and in a controlled manner**.

## Real-World Analogy

> It's like giving someone a **hotel keycard** (token) that opens **only one door**, **only during your stay**, instead of giving them your **master key** (password).

## OAuth 2.0 Key Roles

| Role | Description |
| --- | --- |
| **Resource Owner** | The user who owns the data (e.g., you). |
| **Client** | The app requesting access (e.g., Instagram). |
| **Authorization Server** | Issues tokens (e.g., Google Auth server). |
| **Resource Server** | Hosts the data (e.g., Google Drive API). |

## How OAuth 2.0 Works (Authorization Code Flow – Most Common)

### Step-by-Step

- **Client Redirects User to Authorization Server**

```plaintext
https://authserver.com/auth?client_id=abc&redirect_uri=...&response_type=code&scope=read
```

- **User Logs In & Approves Access**

   - The user logs in to the **authorization server** and grants permission.

- **Authorization Server Sends Back a Code**

   - Redirects back to client app:

```plaintext
https://yourapp.com/callback?code=xyz123
```

- **Client Exchanges Code for Access Token**

   - Backend server sends a `POST` request with:

      - client ID
      - client secret
      - auth code
      - redirect URI

   - Response:

```plaintext
{
  "access_token": "abc123token",
  "refresh_token": "xyz789",
  "expires_in": 3600
}
```

- **Client Uses Access Token to Call API**

   - Adds header:

```plaintext
Authorization: Bearer abc123token
```

- **Access Token Expires**

   - Use `refresh_token` to get a new one without prompting user again.

## Grant Types (Flows)

| Grant Type | Use Case |
| --- | --- |
| **Authorization Code** | Most secure. Used by web apps, SPAs (with PKCE). |
| **Client Credentials** | Machine-to-machine communication (no user). |
| **Implicit** | Legacy for SPAs (now discouraged due to security). |
| **Password Grant** | Direct username/password (discouraged). |
| **Device Code** | For devices without a browser (e.g., smart TVs). |

## Benefits of OAuth 2.0

- **Secure Delegation**: Apps don’t get user passwords.
- **Token Expiry**: Reduces risk of long-term compromise.
- **Fine-Grained Scopes**: Control what an app can access.
- **Standardized**: Widely adopted (Google, Facebook, GitHub, etc.).

## Common Misconception

> OAuth 2.0 is **not** authentication — it's about **delegated access**.\
> To authenticate a user, use **OpenID Connect (OIDC)**, which builds on OAuth 2.0.

## Answers

### Answer by ICSM Computer

**OAuth 2.0** is an industry-standard **authorization framework** that allows third-party applications to access user data **without exposing user credentials** (like passwords).

## What Is OAuth 2.0?

It’s **not authentication** (though often misused that way) — it’s for **granting access to resources**.

OAuth allows a user to **authorize** one application to access their data (e.g., profile, files) on another service **securely and in a controlled manner**.

## Real-World Analogy

> It's like giving someone a **hotel keycard** (token) that opens **only one door**, **only during your stay**, instead of giving them your **master key** (password).

## OAuth 2.0 Key Roles

| Role | Description |
| --- | --- |
| **Resource Owner** | The user who owns the data (e.g., you). |
| **Client** | The app requesting access (e.g., Instagram). |
| **Authorization Server** | Issues tokens (e.g., Google Auth server). |
| **Resource Server** | Hosts the data (e.g., Google Drive API). |

## How OAuth 2.0 Works (Authorization Code Flow – Most Common)

### Step-by-Step

- **Client Redirects User to Authorization Server**

```plaintext
https://authserver.com/auth?client_id=abc&redirect_uri=...&response_type=code&scope=read
```

- **User Logs In & Approves Access**

   - The user logs in to the **authorization server** and grants permission.

- **Authorization Server Sends Back a Code**

   - Redirects back to client app:

```plaintext
https://yourapp.com/callback?code=xyz123
```

- **Client Exchanges Code for Access Token**

   - Backend server sends a `POST` request with:

      - client ID
      - client secret
      - auth code
      - redirect URI

   - Response:

```plaintext
{
  "access_token": "abc123token",
  "refresh_token": "xyz789",
  "expires_in": 3600
}
```

- **Client Uses Access Token to Call API**

   - Adds header:

```plaintext
Authorization: Bearer abc123token
```

- **Access Token Expires**

   - Use `refresh_token` to get a new one without prompting user again.

## Grant Types (Flows)

| Grant Type | Use Case |
| --- | --- |
| **Authorization Code** | Most secure. Used by web apps, SPAs (with PKCE). |
| **Client Credentials** | Machine-to-machine communication (no user). |
| **Implicit** | Legacy for SPAs (now discouraged due to security). |
| **Password Grant** | Direct username/password (discouraged). |
| **Device Code** | For devices without a browser (e.g., smart TVs). |

## Benefits of OAuth 2.0

- **Secure Delegation**: Apps don’t get user passwords.
- **Token Expiry**: Reduces risk of long-term compromise.
- **Fine-Grained Scopes**: Control what an app can access.
- **Standardized**: Widely adopted (Google, Facebook, GitHub, etc.).

## Common Misconception

> OAuth 2.0 is **not** authentication — it's about **delegated access**.\
> To authenticate a user, use **OpenID Connect (OIDC)**, which builds on OAuth 2.0.


---

Original Source: https://www.mindstick.com/interview/34214/what-is-oauth-2-0-and-how-does-it-work

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.