What is OAuth 2.0
Authorization standard for APIs
OAuth 2.0 is an open authorization standard that allows applications to obtain limited access to user resources without sharing passwords.
Main Roles
- Resource Owner — user who owns the data
- Client — application requesting access
- Authorization Server — server issuing tokens
- Resource Server — API with protected resources
Grant Types
- Authorization Code — for server-side applications
- PKCE — for mobile and SPA applications
- Client Credentials — for server-to-server communication
- Refresh Token — for refreshing access tokens
Tokens
- Access Token — short-lived access token (15-60 min)
- Refresh Token — long-lived token for renewal
- ID Token — user information (OpenID Connect)
Use Cases
- Sign in with Google, Facebook, Apple
- Integration with CRM and ERP systems
- Access to cloud service APIs