OAuth 2.0 facilitates delegated authorization, allowing third-party applications to access resources without handling user credentials directly. Instead of sharing passwords, a resource owner issues an access token to a client.
Access Tokens vs. Static Credentials
Distinguishing between tokens and passwords is critical for security architecture:
- Lifecycle: Tokens have a short lifespan and expire automatically. Passwords remain valid until explicitly changed.
- Revocation: Tokens can be invalidated by the server immediately. Password changes affect all sessions globally but are less granular.
- Scope: Tokens carry specific permission scopes (e.g., read-only). Passwords grant full account access.
Authorization Code Flow
This method involves a backend server and ensures the client secret remains confidential.
- Initial Request The application redirects the user to the authorization server with the following query parameters:
GET /oauth/authorize?
response_type=code&
client_id=srv_9928_a&
redirect_uri=https://app.example.com/callback&
scope=api_read
response_type: Indicates the use of an authorization code.redirect_uri: The callback endpoint on the application server.
- User Consents After logging in, the user approves the request. The server redirects back to the application with a temporary code:
GET https://app.example.com/callback?code=T4mp_code_xyz
- Token Exchange The backend exchanges the temporary code for an access token using the client secret.
POST /oauth/token
Content-Type: application/x-www-form-urlencoded
grant_type=authorization_code&
code=T4mp_code_xyz&
client_id=srv_9928_a&
client_secret=sk_secure_key_99&
redirect_uri=https://app.example.com/callback
- Response The server returns JSON containing the credentials:
{
"access_token": "eyJhbGciOiJIUzI1NiIs...",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "dGhpcyBpcyByZWZyZXNo...",
"scope": "api_read"
}
Implicit Flow
Designed for browser-based clients (SPAs) where a backend cannot store secrets. The token is returned directly via the URL fragment.
- Request Specify the response type as a token instead of a code:
GET /oauth/authorize?response_type=token&client_id=srv_9928_a&redirect_uri=http://spa.local/app.html#callback
- Callback Success redirects to the anchor fragment, which never reaches the server:
http://spa.local/app.html#access_token=eyJhbGci...&expires_in=3600
Note: Due to exposure risks in browser history and referer headers, this flow is deprecated in favor of PKCE where possible.
Resource Owner Password Credentials
The client asks the user to enput their username and password directly. This requires high trust in the application.
POST /oauth/token
grant_type=password&username=john.doe&password=secure_pass_123&client_id=srv_9928_a
On sucess, the server responds immediately with a JSON object containing the access token. Avoid this unless you own both the client and the authorization server.
Client Credentials Flow
Used for machine-to-machine communication where no end-user context exists.
- Authentication The service authenticates itself rather than a user:
POST /oauth/token
grant_type=client_credentials&client_id=srv_backend_api&client_secret=sk_machine_to_machine
- Response Access is granted based on the application's identity alone.
Maintaining Session Validity
To extend access without re-authentication, use the refresh token strategy.
POST /oauth/token
grant_type=refresh_token&
refresh_token=dGhpcyBpcyByZWZyZXNo...
The response provides a new access token pair. If the refresh token expires or is revoked, the entire flow must restart.