OAuth 2.0
An authorization framework in which a client obtains scoped access tokens to call a resource server on behalf of a resource owner or itself.
Technical Context
OAuth 2.0 is about delegated authorization, not user identity by itself. Flow selection, redirect URI validation, PKCE, token audience, scope design, refresh-token protection, and confidential/public client distinctions are central to security.
Related Concepts
- OpenID Connect
- access token
- PKCE
- scope