Here’s a simple, beginner-friendly explanation of OAuth 2.0, one of the most widely used authorization frameworks in web development.
🔐 What is OAuth 2.0?
OAuth 2.0 is an authorization framework that lets third-party applications get limited access to a user’s resources without sharing the user’s password.
✅ Authentication = Who are you?
✅ Authorization = What are you allowed to do?
OAuth is about authorization, not authentication.
🧠 Real-World Analogy
Think of OAuth like giving your friend a valet key to your car:
It can start the car but can’t open the glove box.
You don’t give them your main key (i.e., your password).
📦 Who Are the Players in OAuth 2.0?
| Role | Description |
|---|---|
| Resource Owner | The user (you) |
| Client | The third-party app (e.g., Zoom) |
| Authorization Server | The server that grants tokens (e.g., Google OAuth server) |
| Resource Server | The API or service the client wants to access (e.g., Google Calendar API) |
🔄 OAuth 2.0 Flow (Authorization Code Grant)
Most common flow for web apps.
User clicks “Login with Google”
Client app redirects to Google’s OAuth server
User logs in and consents
Google sends back an authorization code
Client app exchanges code for an access token
Client uses access token to call APIs
🔑 Result:
The user is never asked for their Google password by the client app
The app gets limited, revocable access
🔐 Types of OAuth 2.0 Tokens
| Token | Purpose |
|---|---|
| Access Token | Used to access the API (short-lived) |
| Refresh Token | Used to get a new access token without user login (long-lived) |
🧱 Grant Types (OAuth Flows)
| Flow | Use Case |
|---|---|
| Authorization Code | Web & mobile apps with a backend |
| Client Credentials | Server-to-server APIs (no user) |
| Password (not recommended) | Legacy apps (user enters credentials directly) |
| Implicit (deprecated) | Frontend-only SPAs (now replaced by PKCE) |
🛡️ Security Best Practices
Always use HTTPS
Use PKCE (Proof Key for Code Exchange) in public clients (SPAs)
Never store access tokens in localStorage
Implement scopes to limit access (e.g.,
email,profile,calendar.readonly)Tokens should expire and be revocable
🧪 Example: Login with Google (Simplified)
App redirects to:
Google returns a code:
Your backend exchanges the code:
Google responds with:
✅ Summary
| Feature | OAuth 2.0 |
|---|---|
| Purpose | Authorization (not authentication) |
| Uses | Login with Google, Facebook, GitHub, etc. |
| Tokens | Access Token, Refresh Token |
| Benefits | Secure, scalable, revocable access |
| Tools | Google OAuth, Auth0, Okta, Firebase Auth |
