Home/Glossary/OAuth (Open Authorization)

OAuth (Open Authorization)

An open standard for delegated access authorization that allows applications to access user resources without exposing credentials.

Identity & Access ManagementAlso called: "OAuth 2.0", "open authorization"

OAuth enables secure third-party access to user resources without sharing passwords, forming the backbone of modern API security and single sign-on.

Why it matters

Eliminates password sharing between applications, reducing credential exposure.
Enables granular permission scopes, limiting what third-party apps can access.
Required for enterprise identity federation and API ecosystem security.
Foundation for modern authentication protocols like OpenID Connect (OIDC).

How it works

Authorization Grant: User approves access via consent screen.
Access Token: Short-lived credential for API requests.
Refresh Token: Long-lived token to obtain new access tokens.
Scopes: Define specific permissions (read email, access calendar).
Authorization Server: Issues tokens after validating user consent.

Common OAuth flows

Authorization Code Flow: Most secure, used for web and mobile apps.
Client Credentials Flow: Service-to-service authentication.
Implicit Flow: Legacy browser-based flow (deprecated).
PKCE Extension: Protects authorization code flow from interception.

Security considerations

Always validate redirect URIs to prevent token theft.
Use PKCE for mobile and single-page applications.
Implement token rotation and expiration policies.
Monitor for unusual authorization patterns or scope requests.

Related Tools

Explore More Identity & Access Management

Authentication vs Authorization

Authentication verifies who you are, while authorization determines what you can do.

Identity and Access Management (IAM)

The policies and technologies used to verify identities, govern permissions, and log access across systems.

Multi-Factor Authentication (MFA)

An authentication method that requires users to provide two or more verification factors to gain access.

Privileged Access Management (PAM)

A framework for securing and auditing accounts with elevated permissions, such as admins, service accounts, and break-glass users.

Session Management

The process of securely maintaining user state and authentication across multiple HTTP requests.

←Back to glossary