All Concept Bites
12 views
Securityintermediate
What is OAuth?
A delegated authorisation flow that avoids sharing the user's password
Reviewed by Abhijith N M · 24 October 2026 · Editorial standards
The Simple VersionNo jargon
OAuth lets an application obtain limited access to a user's account on another service without seeing the password. The app redirects the user to the provider, the user approves specific scopes, and the provider returns a short-lived authorisation code. The app exchanges that code, plus its client secret, for an access token. OpenID Connect adds an ID token and standard user info on top. OAuth is authorisation; authentication is a layer built on it.
What is OAuth? — Visual Breakdown
Click any step below to inspect
You
nexGenCoders
Google
(OAuth Provider)
Sequence of Events
Why It Matters in Production
The most common mistake is using the implicit flow or putting tokens in the URL. Use authorisation code with PKCE for public clients, including single-page apps and mobile. Validate the state parameter to prevent CSRF, and validate the ID token signature, issuer and audience. Request the smallest scopes you need. Store refresh tokens server-side and rotate them. Do not build your own OAuth provider unless you have to; the edge cases around redirects, consent and token lifetimes are where breaches live.
Quick Concept Check
Test your understanding in 15 seconds
Does OAuth share your password with the third-party app?
Related Concepts
Written and edited by the nexGenCoders team. Spotted a mistake? Tell us and we will fix it.