What is OAuth?
OAuth (Open Authorization) is an open standard authorization framework that allows third-party applications to access user resources on a server without exposing the user's credentials, using access tokens instead of passwords.
How Does OAuth Work?
OAuth solves the problem of delegated access: how can you let an application access your data on another service without giving it your password? When you click "Sign in with Google" or "Connect with GitHub," you are using OAuth. The process involves redirecting the user to the resource provider (like Google), where they grant permission. The provider then issues an access token to the requesting application, which can use that token to access only the specific resources the user authorized.
OAuth 2.0 is the current version and defines several grant types (authorization flows) for different scenarios: the Authorization Code flow for server-side web apps, the PKCE extension for mobile and single-page apps, the Client Credentials flow for machine-to-machine communication, and others. OAuth is often used alongside OpenID Connect (OIDC), which adds an identity layer for authentication. Proper implementation of OAuth is critical for security — common pitfalls include insufficient token validation, overly broad scopes, and insecure token storage.