OAuth
An open standard for access delegation that allows users to grant third-party applications limited access to their accounts without sharing passwords.
Detailed Explanation
OAuth is the protocol behind "Login with Google/GitHub/Facebook" buttons. Instead of giving your password to a third-party app, OAuth lets you authorize that app to access specific parts of your account through tokens. The app never sees your password.
OAuth 2.0, the current version, defines several grant types for different scenarios: authorization code (most secure, for server-side apps), implicit (legacy, for single-page apps), resource owner password (for trusted apps), and client credentials (for machine-to-machine). OAuth works alongside OpenID Connect (OIDC) for identity verification and JWT for token format.
Why It Matters
OAuth is the foundation of modern authentication and authorization. It powers social login, API access, and delegated permissions across the web.
Real-World Example
When you authorize a third-party app to access your Google Calendar, OAuth grants it a token with specific permissions (read events, create events) without giving it your Google password.
When to Use
When building social login features, third-party API integrations, or any system where users need to grant limited access to their accounts.
Advantages
- Users don't share passwords with third parties
- Fine-grained permission control
- Tokens can be revoked independently
- Industry standard with wide library support
- Enables secure API access patterns
Disadvantages
- Complex implementation compared to simple auth
- Multiple grant types can be confusing
- Token management adds complexity
- Redirect-based flows can be disorienting for users
- Security depends on proper implementation
Related Terms
Frequently Asked Questions
What is the difference between OAuth and OpenID Connect?
OAuth handles authorization (what you can do). OpenID Connect handles authentication (who you are). OIDC is built on top of OAuth 2.0 and adds an identity layer with user profile information.
Do I need OAuth for my app?
If you need social login (Login with Google), third-party API access, or delegated permissions, yes. For simple username/password authentication, you can use JWT-based auth without OAuth.
What is an OAuth grant type?
A grant type is a method for obtaining an access token. Authorization Code is most common for web apps. Client Credentials is for server-to-server. PKCE is recommended for mobile and SPA apps.
Is OAuth the same as SSO?
No. OAuth is about delegating access to third parties. SSO (Single Sign-On) lets you log in once and access multiple related applications. They often work together—SAML or OIDC handle SSO, and OAuth handles API access.
How do I implement OAuth?
Use established libraries rather than implementing OAuth yourself. Passport.js (Node.js), NextAuth.js, and Auth.js handle the complexity. For hosted solutions, consider Auth0, Clerk, or Supabase Auth.