OAuth
An open standard for secure access delegation, allowing users to grant limited access to resources without sharing passwords.
What is OAuth?
OAuth (Open Authorization) is an open standard for access delegation. It allows users to grant third-party applications limited access to their resources (on another service) without sharing their passwords.
OAuth has two main versions:
- OAuth 1.0 (RFC 5849): Required cryptographic signatures (complex, mostly deprecated)
- OAuth 2.0 (RFC 6749): Uses bearer tokens (simpler, widely adopted)
OAuth 2.0 defines four grant types (flows):
- Authorization Code: For server-side apps (most secure, with PKCE for mobile)
- Implicit: For browser-based apps (deprecated in OAuth 2.1)
- Resource Owner Password Credentials (ROPC): Username/password directly (not recommended)
- Client Credentials: For machine-to-machine communication
Note: OAuth is for authorization (access), not authentication (identity). OpenID Connect adds authentication on top of OAuth 2.0.
Analogy
Think of OAuth like giving a hotel valet a key that only starts the engine and opens the trunk, but can't access your glove box or personal items. You grant limited access without handing over your master key (password).
Types and Use Cases
- Social Login: "Sign in with Google" uses OAuth 2.0 to access user's basic profile
- Third-Party Integrations: Allow apps to access Google Drive, GitHub repos, or Twitter posts
- API Access: Grant limited API access to partners or third-party developers
- Mobile Apps: Use OAuth 2.0 with PKCE for secure mobile authentication
How it Works
// OAuth 2.0 Authorization Request
GET /oauth/authorize?
client_id=1234567890&
response_type=code&
scope=https://www.googleapis.com/auth/drive.readonly&
redirect_uri=https://app.example.com/callback&
state=xyz123
// Token Response
{
"access_token": "ya29.a0AfH6SMB...",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "1//03..."
}
// API Call with Access Token
GET /drive/v3/files
Authorization: Bearer ya29.a0AfH6SMB...OAuth vs OpenID Connect
OAuth
OpenID Connect
OAuth 2.0 is for authorization (access to resources)
OpenID Connect adds authentication (who is the user)
OAuth provides access tokens
OIDC provides ID tokens + access tokens
Use OAuth when app needs access to user's resources
Use OIDC when app needs to know who the user is
Best Practices for OAuth
- Use authorization code flow: Avoid implicit flow (deprecated in OAuth 2.1) - use authorization code with PKCE
- Validate redirect URIs: Strictly whitelist redirect URIs to prevent open redirect attacks
- Use scopes minimally: Only request the permissions you actually need (principle of least privilege)
How LoginRadius Powers OAuth
LoginRadius CIAM platform provides comprehensive OAuth 2.0 support. As an OAuth Provider, LoginRadius issues access tokens for your applications to securely call LoginRadius APIs. As an OAuth Client, LoginRadius connects to 40+ social providers (Google, Facebook, Microsoft) via OAuth 2.0 for social login. Our platform handles the complete OAuth flow including authorization code exchange, token refresh, scope validation, and PKCE for mobile apps. LoginRadius also provides OAuth 2.0 debugging tools and detailed logs for troubleshooting.
FAQs
OAuth 1.0 required cryptographic signatures (complex to implement, uses HMAC-SHA1) and is largely deprecated. OAuth 2.0 uses bearer tokens (simpler, but requires HTTPS to be secure) and is the current standard. OAuth 2.0 is not backwards compatible with 1.0. Most implementations today use OAuth 2.0. LoginRadius supports OAuth 2.0 with all major providers.
OAuth 2.0 is specifically for authorization - granting access to resources without sharing passwords. If you need authentication (verifying who the user is), you should use OpenID Connect, which is built on top of OAuth 2.0. Confusingly, many 'OAuth login' implementations are actually using OpenID Connect (which includes OAuth 2.0). Pure OAuth 2.0 doesn't tell you who the user is - only that they granted access.
LoginRadius supports OAuth 2.0 in multiple ways: (1) As an OAuth Provider - issue access tokens for your applications to access LoginRadius APIs, (2) OAuth Client - connect to social providers (Google, Facebook) via OAuth 2.0 for social login, (3) Custom OAuth - connect to any OAuth 2.0-compliant provider. LoginRadius handles the complete OAuth flow, token management, refresh tokens, and scope validation. Our platform also supports OpenID Connect for authentication scenarios.