OAuth authentication is a secure way for users to authorize third-party applications or services to access their data—without sharing their passwords. Instead of giving out credentials, users grant permission through an authorization process, after which the application receives an access token. This token can be used to perform only the specific actions (scopes) the user approved.
Key Points
- Delegated Authorization: Instead of entering credentials into the app, the user is redirected to a trusted identity provider (such as Google, Microsoft, or Facebook). After authenticating, the user is asked what information or permissions to grant to the third-party app.
- Token-Based: The app receives a temporary access token from the identity provider. This token acts as proof of the user’s consent and can be used to retrieve data or perform actions on the user’s behalf.
- No Password Sharing: The user’s password is never shared with the requesting app, reducing the risk of credential theft.
- Scopes: OAuth lets the user (and the app) specify exactly which data or actions are allowed, such as reading an email address or posting content.
Typical Workflow
- User wants to use an app that needs access to a protected resource (like calendar or contacts).
- The app redirects the user to the identity provider’s login page.
- User authenticates (logs in) and is presented with a consent screen detailing which resources the app wants.
- If consent is granted, the app receives an access token (and sometimes a refresh token).
- The app uses the token to access the requested resources—without ever seeing the user’s password.
Security Considerations
- OAuth tokens should be kept secure, as they grant access similar to passwords within their permitted scope.
- Attackers may attempt to steal tokens via phishing or through attacks on poorly secured apps.
- It’s vital for users to periodically review which applications have OAuth permissions and revoke access for those that are unnecessary or suspicious.
Synonyms:
OAuth