←  All terms
O
Security & Compliance

OAuth

OAuth is an authorization framework that grants applications limited resource access without sharing user passwords.

OAuth is an authorization framework that grants applications limited resource access without sharing user passwords. The appropriate design depends on the data, risk, and jurisdiction and requires both technical and organizational review. The concept is closely related to OpenID Connect and API.

Read more

OpenID Connect

API

Authorization

Authentication

FAQ

OAuth

When is OAuth used in API integrations?
OAuth is used when an application accesses a third-party API on behalf of a user, such as with calendar, CRM, or social media connections. For pure server-to-server communication without a user context, client credentials or API keys are often sufficient. The choice depends on protection needs and on what the API supports.
What typical mistakes occur in OAuth implementations?
Typical problems are overly broad scopes, insufficiently validated redirect URIs, tokens stored in the browser, and home-built flows instead of vetted libraries. Missing token renewal causes trouble as well. Because OAuth is a framework with many variants, the flow and its configuration should be reviewed from a security standpoint.
What are scopes and tokens in OAuth?
A token is the proof with which an application gains access. Scopes define what that access covers, for example read instead of write. Short lifetimes and narrow scopes limit the damage if a token is lost. Overly broad permissions are a frequent risk in configuration.
How does the OAuth flow work in simplified terms?
An application redirects users to the authorization server, where they confirm the access. The server then issues an access token with limited scope and lifetime, which the application uses to call the resource API. The password stays with the provider. Which flow fits depends on the type of application.
What is the difference between OAuth and OpenID Connect?
OAuth handles authorization: an application receives limited access to resources. OpenID Connect builds on it and adds authentication, meaning the answer to who has signed in. Plain OAuth is therefore not suited as a login method. Once the identity of users is needed, OpenID Connect comes into play.