01 · What is it?
OAuth separates the application asking for access from the service that owns the user’s protected data.
The user or resource owner grants access through an authorization server, which issues a limited credential to the client.
MODULE 06 · AUTHENTICATION & SECURITY
OAuth
OAuth is a framework that lets an application obtain limited access to a protected service without receiving the user’s primary password.
02 · Think of it like...
Think of OAuth like giving a valet a time-limited parking pass instead of your house keys.
The pass can allow one task for one period, while the owner keeps the original keys and can revoke the pass.
User→Authorization server→Access token→Protected API
03 · What does it do?
Delegate Access
Allow an application to act within a defined grant.
Limit Scope
Restrict which resources or actions the client may use.
Separate Credentials
Keep the user’s primary password away from the client application.
Support Revocation
Withdraw a grant or token without changing the user’s main password.
04 · Where is it used?
OAuth is common when one application needs delegated access to another service.
Sign in with a provider
A client uses an identity provider’s authorization flow.
Third-party integrations
An application accesses selected user data from another service.
Mobile and web apps
Public clients obtain access without storing a client secret in the app.
Service access
A confidential client uses a grant suited to service-to-service access.
05 · Example
Client: a calendar application
Scope: read calendar events
Result: an access token for the selected scope
The calendar application sends the access token to the calendar API. The API checks the token and scope before returning events.
06 · How it connects
Client requests access→User grants scope→Authorization code→Access token
The exact grant and exchange depend on the client type and the security requirements of the flow.
07 · Do Not Confuse
OAuth
A framework for delegated authorization.
Authentication
The act of establishing who a user or client is.
JWT
A token format that may be used to carry claims; it is not the OAuth framework itself.
08 · Topic Glossary
| ENGLISH TERM | 中文 | SIMPLE ENGLISH | 中文小白理解 |
|---|---|---|---|
| OAuth | OAuth 授权 | A framework for delegated access. | 一种用于委托访问权限的框架。 |
| Client | 客户端 | The application asking for access. | 请求访问权限的应用。 |
| Scope | 范围 | The permissions included in a grant. | 一次授权中包含的权限范围。 |
| Access Token | 访问令牌 | A credential used to call a protected API. | 用来调用受保护 API 的凭证。 |
| Authorization Server | 授权服务器 | The service that issues authorization results or tokens. | 负责发出授权结果或令牌的服务。 |
09 · What to Remember
OAuth lets a client receive limited delegated access without handling the user’s primary password.
Always treat access tokens as sensitive credentials and keep scopes as narrow as the task allows.