{"id":47006,"date":"2023-03-13T15:50:01","date_gmt":"2023-03-13T15:50:01","guid":{"rendered":"https:\/\/www.arimetrics.com\/glosario-digital\/oauth"},"modified":"2026-10-01T12:45:21","modified_gmt":"2026-10-01T12:45:21","slug":"oauth","status":"publish","type":"encyclopedia","link":"https:\/\/www.arimetrics.com\/en\/digital-glossary\/oauth","title":{"rendered":"OAuth"},"content":{"rendered":"<p><strong>Definition:<img decoding=\"async\" class=\"boxpad alignright wp-image-46988 size-full\" src=\"https:\/\/www.arimetrics.com\/wp-content\/uploads\/2023\/03\/OAuth.jpg\" alt=\"OAuth\" width=\"300\" height=\"300\" srcset=\"https:\/\/www.arimetrics.com\/wp-content\/uploads\/2023\/03\/OAuth.jpg 300w, https:\/\/www.arimetrics.com\/wp-content\/uploads\/2023\/03\/OAuth-150x150.jpg 150w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/strong><\/p>\n<p><strong>OAuth<\/strong> is an open authorization framework that allows an application to obtain limited access to protected resources on another service without receiving the user&#8217;s password. Access is represented by specific credentials and can be restricted by scope, duration, and context.<\/p>\n<p>It is commonly used to <strong>connect applications<\/strong> to an <a href=\"https:\/\/www.arimetrics.com\/en\/digital-glossary\/api\">API<\/a>. When a service requests permission to read a calendar, publish content, or access selected account data, OAuth organizes the granting and use of that permission. The user authenticates with the provider that controls the resource, not with the application requesting access.<\/p>\n\n<h2>Authorization and authentication<\/h2>\n<p>OAuth primarily answers an <strong>authorization<\/strong> question: what an application may do with specific resources. It does not by itself define how to prove a person&#8217;s identity or provide the application with a reliable user profile.<\/p>\n<p>The provider&#8217;s sign-in screen may be part of the experience, but that step does not turn OAuth into an authentication protocol. Signing in with a federated identity commonly uses <strong>OpenID Connect<\/strong>, an identity layer built on OAuth 2.0 that adds an ID Token and rules for verifying the user.<\/p>\n<p>This separation makes it possible to grant access without sharing credentials. It also allows <strong>permission<\/strong> for one application to be revoked without changing the password or removing access from every other connected application.<\/p>\n<h2>Participants and flow<\/h2>\n<p>An OAuth operation coordinates several roles. One system may perform more than one of them, but each role has a distinct responsibility:<\/p>\n<ul>\n<li><strong>Resource owner:<\/strong> The person or entity capable of authorizing access.<\/li>\n<li><strong>Client:<\/strong> The application requesting permission to act.<\/li>\n<li><strong>Authorization server:<\/strong> The system that obtains the decision and issues tokens.<\/li>\n<li><strong>Resource server:<\/strong> The service protecting the requested information or function.<\/li>\n<\/ul>\n<p>In a common flow, the client directs the user to the <strong>authorization server<\/strong>. The server identifies the client and displays the requested permissions. After the decision, the client receives an intermediate credential or a token, depending on the flow. The resource server then validates the token before responding to the <a href=\"https:\/\/www.arimetrics.com\/en\/digital-glossary\/http\">HTTP<\/a> request.<\/p>\n<p>Redirection prevents the client application from handling the provider&#8217;s password. The design must still <strong>validate destinations<\/strong>, associate each response with its request, and protect credentials from disclosure.<\/p>\n<h2>Tokens and scope<\/h2>\n<p>An <strong>access token<\/strong> represents the authorization granted. The client presents it to the resource server to perform allowed actions while the token remains valid. It may be an opaque string or use a structured format; OAuth does not require every token to be a JWT.<\/p>\n<p>The <strong>scope<\/strong> expresses the permissions requested or granted. A provider may separate reading data from modifying it, for example. The server applies its own policies, so the scope requested by the client is not necessarily granted in full.<\/p>\n<p>A <strong>refresh token<\/strong> may allow the client to obtain new access tokens without repeating the complete user interaction. It is not sent to the resource API and requires stronger protection. Its availability, lifetime, rotation, and revocation depend on the authorization server and the client type.<\/p>\n<p><strong>Bearer tokens<\/strong> allow whoever possesses them to act while they remain valid. They must therefore travel over protected channels, be stored carefully, and be limited to the resources required.<\/p>\n<h2>Authorization flows<\/h2>\n<p>OAuth 2.0 supports different mechanisms for obtaining authorization. The appropriate choice depends on whether a person is involved, whether the client can keep secrets, and how the systems relate to each other.<\/p>\n<ul>\n<li><strong>Authorization code:<\/strong> The client exchanges a temporary code for tokens. PKCE binds that exchange to the initial request and protects against code interception.<\/li>\n<li><strong>Client credentials:<\/strong> An application obtains access on its own behalf without representing a person.<\/li>\n<li><strong>Specialized grants:<\/strong> Extensions such as Device Authorization cover devices with limited input or browser access.<\/li>\n<\/ul>\n<p><strong>Current practice<\/strong> advises against the implicit flow and prohibits using the user&#8217;s password as a grant. It also requires strict redirect URI matching, request-forgery protections, and encrypted transport. These measures complement the protocol and reduce known risks, but they cannot repair a faulty application or <a href=\"https:\/\/www.arimetrics.com\/en\/digital-glossary\/api-rest\">REST API<\/a> implementation.<\/p>\n<h2>Evolution of the standard<\/h2>\n<p>OAuth grew from community work that began in 2006 to solve access delegation between web services. OAuth 1.0 was formalized as RFC 5849 in 2010. OAuth 2.0 was published as RFC 6749 in 2012, replaced the earlier protocol, and defined a different framework that is not directly compatible with OAuth 1.0.<\/p>\n<p>The 2012 specification has been extended through RFCs covering tokens, native applications, metadata, revocation, and other scenarios. <strong>Security practice<\/strong> RFC 9700, published in 2025, updates the recommendations based on observed threats and implementations and deprecates some older modes of operation.<\/p>\n<p>OAuth does not make an integration secure automatically. <strong>Final protection<\/strong> depends on the requested permissions, redirect validation, token management, and consistent enforcement of policies by every participant.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Definition: OAuth is an open authorization framework that allows an application to obtain limited access to protected resources on another service without receiving the user&#8217;s password. Access is represented by specific credentials and can be restricted by scope, duration, and context. It is commonly used to connect applications to an API. When a service requests [&hellip;]<\/p>\n","protected":false},"author":28,"featured_media":0,"template":"","encyclopedia-tag":[1405,1263],"class_list":["post-47006","encyclopedia","type-encyclopedia","status-publish","hentry","encyclopedia-tag-network-access","encyclopedia-tag-web-encryption"],"_links":{"self":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/encyclopedia\/47006","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/encyclopedia"}],"about":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/types\/encyclopedia"}],"author":[{"embeddable":true,"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/users\/28"}],"wp:attachment":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/media?parent=47006"}],"wp:term":[{"taxonomy":"encyclopedia-tag","embeddable":true,"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/encyclopedia-tag?post=47006"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}