OAuth 2.0

Overview

OAuth 2.0 is an authorization framework that allows third-party applications to access resources without sharing user passwords.

Main Roles

• Resource Owner
• Client Application
• Authorization Server
• Resource Server

sequenceDiagram
    participant User
    participant Client
    participant AuthzServer
    participant ResourceServer
    User->>Client: Start sign-in
    Client->>AuthzServer: Authorization request
    AuthzServer-->>Client: Authorization code
    Client->>AuthzServer: Exchange code for token
    AuthzServer-->>Client: Access token
    Client->>ResourceServer: API call with token
    ResourceServer-->>Client: Protected data

Practical Example

Authorization code flow is commonly used for web applications with backend servers.

GET /authorize?response_type=code&client_id=app123&scope=openid profile

Production Example

An internal dashboard accesses a billing API using OAuth scopes such as billing.read and billing.write, enforced by API gateway policies.

Common Pitfalls

• Using implicit flow where authorization code with PKCE is preferred
• Requesting broad scopes unnecessarily
• Failing to validate token audience and issuer

Key Takeaways

• OAuth 2.0 separates authentication concerns from API authorization.
• Scope design should follow least privilege.
• Token validation rules are mandatory for secure APIs.