What is OAuth?

1 min read Updated 2026-02-05

An open standard for access delegation. Allows users to grant third-party applications limited access to their resources without sharing credentials.

Related: Authentication Authorization JWT

Understanding OAuth

OAuth 2.0 is the industry standard for authorization. It enables users to grant apps access to their data on other services without sharing passwords. Common flows include Authorization Code (web apps), PKCE (mobile/SPA), and Client Credentials (server-to-server).

Examples

  • "Login with Google" or "Login with GitHub" buttons
  • Apps requesting access to your Google Drive files
  • Third-party apps posting to your Twitter account

How to Prevent

  • Use Authorization Code flow with PKCE for public clients
  • Validate redirect URIs strictly
  • Request minimal scopes needed
  • Store tokens securely
  • Implement token refresh properly
  • Validate state parameter to prevent CSRF

Worried about OAuth in your app?

Our security audits identify vulnerabilities like this before attackers do. Get expert manual review of your codebase.

Get a Security Audit Back to Glossary