Understanding OAuth

OAuth is an open standard that allows users to grant limited access to their data on one site to other sites or applications without exposing their passwords.

The OAuth ecosystem

OAuth connects three main players:

- The User who wants to grant access to their data without sharing login credentials
- The Server that hosts the user's data and provides access tokens
- The Identity Provider (IdP) that authenticates the user's identity and issues tokens

How OAuth works

When a user tries to access their data through a third-party app, they are redirected to log in through the IdP. The IdP sends an access token to the app, which presents it to the server. Recognizing the valid token, the server grants access.

The OAuth flows

OAuth 2.0 defines 4 flows for obtaining authorization tokens:

- Authorization Code Flow - for server-side applications
- Client Credentials Flow - when the app is the resource owner
- Implicit Code Flow - not secure and no longer recommended
- Resource Owner Flow