What it means
OAuth separates the resource owner, client, authorization server, and protected resource. The client receives an access token representing approved scope and conditions, then presents that token to an API. OAuth is primarily about delegated authorization; it is not, by itself, a complete user-authentication protocol.
How it works
Secure deployments choose an appropriate flow, validate redirect URIs, bind authorization responses to requests, protect tokens, restrict scopes and audiences, and handle expiration and revocation. Authorization Code with Proof Key for Code Exchange is widely used for browser and native applications.
A photo-printing application asks for permission to read selected photos from a storage service. The user authorizes that limited access at the storage provider, and the printing application receives a token rather than the user's storage password.
Practical focus
- Use exact redirect-URI matching and PKCE where applicable
- Issue narrowly scoped, audience-restricted, short-lived tokens
- Protect refresh tokens and rotate them when supported
- Validate issuer, audience, signature, expiration, and authorization at the API
Common mistakes
- Using OAuth access tokens as proof of user identity without an identity layer
- Putting long-lived bearer tokens in URLs or browser storage carelessly
- Granting broad scopes because fine-grained authorization is difficult
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: