What is OAuth 2.0?
OAuth 2.0 is an authorization framework for granting an application limited access to resources at another service. It is not itself an identity protocol.
How it works and where it is used
1. How it works Resource owner, client, authorization server and resource server are separate roles. In a code flow, consent leads to a code exchanged for scoped, time-limited tokens. 2. Applications and examples An app can gain narrowly scoped calendar or file access. OpenID Connect adds identity features when needed; “sign in with” can mask different models.
Limits and good practice
3. Limitations and security Token leaks, broad scopes and incorrect redirect URIs are risks. Current guidance favors authorization code with PKCE and strict redirects over older flows. 4. Practical considerations Review requested scopes and app identity. Developers should protect tokens, limit lifetimes, support revocation and follow current security guidance.