What is OAuth 2.0?
OAuth 2.0 is an authorization framework that enables third-party applications to access user resources without exposing credentials.
OAuth 2.0 is an authorization framework that enables third-party applications to access user resources without exposing credentials. It's the industry standard for API authorization — powering "Sign in with Google," "Connect to GitHub," and virtually all third-party API integrations.
OAuth 2.0 flows: Authorization Code (most secure, for server-side apps), PKCE (secure extension for mobile/SPA apps), Client Credentials (machine-to-machine, no user context), and Device Code (for devices without browsers, like CLI tools and TVs).
Key concepts: Access tokens (short-lived, authorize API access), Refresh tokens (long-lived, obtain new access tokens), Scopes (permissions requested), and OIDC (OpenID Connect, identity layer on top of OAuth for authentication).
Why It Matters
OAuth 2.0 is the foundation of API security. Any application that integrates with third-party services or provides API access to third parties needs OAuth. Implementing it incorrectly creates severe security vulnerabilities.
Frequently Asked Questions
What is OAuth 2.0?
An authorization framework that lets third-party apps access user resources without credentials. Powers "Sign in with Google" and virtually all API integrations. Not authentication — that's OIDC on top of OAuth.
OAuth vs API keys?
API keys identify the application. OAuth authorizes the application to act on behalf of a user. Use API keys for server-to-server calls without user context. Use OAuth when users need to grant access to their data.
Related Terms
Need Expert Help?
Richard Ewing is a Product Economist and AI Capital Auditor. He helps companies translate technical complexity into financial clarity.
Book Advisory Call →