What is OAuth?

What is OAuth?

OAuth 2.0 is an authorization framework that lets a user grant a third-party application access to their account on another service - without sharing their password. The user authenticates with the provider, which issues a short-lived access token to the application.

When Is OAuth Used?

OAuth is used when an app acts on behalf of a user: “Log in with Google”, scheduling tools reading your calendar, or a dashboard pulling data from Stripe. It is also used for machine-to-machine access in some APIs.

Tokens and Scopes

An access token is sent as Authorization: Bearer <token> on each API call. Tokens carry a scope (e.g. read:orders) limiting what they can do, and they expire. A refresh token obtains a new access token without re-prompting the user.