The problem OAuth solves

OAuth 2.0 Course · lesson 1 of 13 · 3 min read

Before OAuth, letting an app read your data meant handing it your password.

Open this lesson in the learning hub

Key points

  • A third-party app wants your data from another service. The naive answer is to give it your password.
  • That gives it everything, forever, with no way to limit or revoke it except changing your password.
  • OAuth 2.0 is delegated authorisation: the app gets a scoped, expiring token instead.
  • You authenticate at the service you already trust; the app never sees your credentials.
  • OAuth is about authorisation (what may this app do), not authentication (who are you) - that is OpenID Connect.

OAuth exists so an app can act for you without ever holding your password.

The four roles

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the OAuth 2.0 Course course, and every lesson in it is listed on the OAuth 2.0 Course contents page.