OAuth

OAuth (Open Authorization) is a widely adopted authorization framework used to enable secure, delegated access between applications without exposing sensitive credentials.

Definition

OAuth, short for Open Authorization, is an open-standard protocol that allows a user to grant a third-party application limited access to protected resources on another service without sharing their login credentials. It operates by issuing scoped access tokens that define what data and actions the requesting app is allowed to perform on behalf of the user. While often associated with “login with X” flows, its core purpose is authorization rather than authentication. OAuth 2.0, the most common version, defines several grant types to support web, mobile, and machine-to-machine access scenarios, enabling secure API interactions and delegated resource access in modern applications. Implementations vary across ecosystems, but the underlying principle remains scoped, token-based access without credential exposure.

Pros

• Enhances security by avoiding direct sharing of user credentials with third-party apps.
• Granular access control through scopes limits permissions to only what’s needed.
• Widely supported across web, mobile, and API ecosystems.
• Standardized token-based model simplifies integration with external services.
• Reduces friction for users by enabling single-consent workflows for multiple services.

Cons

• Can be complex to implement correctly due to multiple flows and optional specs.
• OAuth itself doesn’t authenticate user identity.
• Token management and lifecycle must be carefully handled to avoid security issues.
• Different implementations by providers may lead to interoperability challenges.
• Misconfiguration can expose access tokens or grant excessive permissions.

Use Cases

• Allowing a third-party app to access a user’s profile data without requiring their password.
• Integrating services like calendar or contacts across platforms securely.
• Enabling API access for server-to-server communication using client credentials.
• Supporting social login options (e.g., “Sign in with Google”) via delegated authorization.
• Authorizing IoT devices or native apps to access cloud resources on behalf of users.