API Fundamentals
/Advanced
OAuth 2.0
Definition
The industry-standard protocol for authorization. It allows a user to grant a third-party application limited access to their resources on another site, without giving the third-party application their password.
Explain Like I'm New
You download a new mobile game. It asks to 'Find your friends on Facebook'. You DO NOT give the game your Facebook password. Instead, the game redirects you to Facebook. You log into Facebook, click 'Allow', and Facebook gives the game a temporary 'Key' (Access Token) that only allows it to read your friends list, nothing else.
Real World Example
'Log in with Google', 'Log in with GitHub', or giving a calendar app permission to read your Google Calendar.
Common Use Cases
- •Third-party integrations
- •Single Sign-On (SSO)
- •Delegated access
Terminal Output
bash / terminal
/*
The OAuth 2.0 Authorization Code Flow:
1. The User clicks 'Import Google Contacts' in your App.
2. Your App redirects the user to `accounts.google.com/oauth?client_id=123&scope=contacts.read`
3. User logs into Google and clicks "Approve".
4. Google redirects the user back to your App with a short-lived "Authorization Code" in the URL.
5. Your Backend Server secretly sends that Code + your App's Secret Password to Google.
6. Google verifies them and sends your Backend an "Access Token".
7. Your Backend uses that Access Token to fetch the contacts from the Google API.
*/
Interview Questions
basic
- Is OAuth 2.0 primarily designed for Authentication (Who you are) or Authorization (What you can do)?
intermediate
- In the OAuth flow, what is the difference between an Access Token and a Refresh Token?