OAuth 2.0
OAuth 2.0 is the standard authorization framework for delegated access. It lets a client obtain limited access to a resource owner's data without handling their credentials. OAuth 2.0 is defined by RFC 6749; modern usage should follow OAuth 2.1 guidance, which removes deprecated flows and bakes in PKCE.
The most common OAuth mistake is using it for authentication. OAuth answers "may this client access that resource", not "who is this person", and building a login on the presence of an access token produces well-known impersonation bugs. Use OIDC when you need identity. OAuth 2.1 consolidates the current best practice: authorization code with PKCE everywhere, no implicit flow, no password grant.
See also: OAuth 2.0, OAuth 2.1, OAuth vs OIDC, protect an API with OAuth scopes recipe
Related on Start with Identity
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GlossaryID Token
A JWT issued by an OpenID Connect provider that conveys authentication claims about the user. Unlike access tokens, ID tokens are intended for the client, not f
- BlogConsentFix: hijacking Microsoft 365 through the OAuth consent flow
ConsentFix adapts the ClickFix pattern to identity. Instead of running a command on the victim's machine, it walks them through an OAuth consent flow and asks t
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still