OAuth, short for Open Authorization, is an open standard framework that allows a user to grant a third-party application limited access to their resources on another service, without sharing their actual credentials (username and password) with that third-party application. It is the mechanism behind the familiar experience of “Log in with Google” or authorizing an app to access your data on another platform: instead of handing over your password, you authorize delegated, scoped access through tokens. The current widely used version is OAuth 2.0.
The core problem OAuth solves is delegated authorization. Suppose you want a photo-printing app to access photos stored in your cloud account. Without OAuth, you might have to give the printing app your cloud password – a serious security and privacy risk, granting it full access and requiring you to trust it with your credentials. OAuth instead lets you authorize the printing app to access only your photos, only for as long as needed, without ever revealing your password. The service issues the app an access token representing this specific, limited permission.
Conceptually, OAuth involves several roles: the resource owner (the user who owns the data), the client (the third-party application requesting access), the authorization server (which authenticates the user and issues tokens), and the resource server (which holds the protected resources and accepts tokens). The user authenticates with the authorization server and consents to specific permissions (scopes); the authorization server issues an access token to the client; and the client presents that token to the resource server to access the permitted resources. Tokens are scoped (limited to certain permissions), often time-limited, and can be revoked.
OAuth is fundamental to modern API security because APIs are commonly protected using OAuth access tokens: a client presents a token to authenticate and authorize its API requests. This enables secure, delegated, granular access without password sharing, and supports scenarios involving many applications, users, and services. Access tokens are frequently implemented as JSON Web Tokens (JWTs).
However, OAuth’s security depends heavily on correct implementation, and misimplementation is a common source of vulnerabilities. Weaknesses can include improper token validation, insecure token storage or transmission, overly broad scopes, failure to expire or revoke tokens, and flaws in the authorization flows themselves – issues that fall under broken authentication and authorization risks. Attackers who steal or forge tokens can gain unauthorized access. Using OAuth securely therefore requires careful adherence to the standard’s best practices: validating tokens properly, using appropriate flows for each application type, enforcing least-privilege scopes, protecting tokens in storage and transit (over TLS), setting sensible token lifetimes, and supporting revocation. Properly implemented, OAuth is a powerful and widely adopted framework for secure, delegated access to APIs and services.