TOPIC SECURITY
OAuth 2.0 how apps get limited access to your data without your password
IN 10 SECONDS
A protocol where a user authorizes a third-party app (client) to access their data on another service (resource server). Instead of sharing a password, the client gets an access token — scoped, time-limited, and revocable. The authorization code flow is the gold standard for web apps.
GOTCHA Never expose `client_secret` in a frontend app (SPA, mobile). Use PKCE (Proof Key for Code Exchange) instead — it replaces the secret with a cryptographic challenge that can't be intercepted.
HOW THE AUTHORIZATION CODE FLOW WORKS
01 User clicks 'Sign in with Google' on a website (the client).
02 Client redirects the user to Google's authorization endpoint with `client_id`, `redirect_uri`, and `scope`.
03 User authenticates with Google and clicks 'Allow'. Google redirects back with a short-lived `authorization_code`.
04 Client exchanges the code + `client_secret` for an `access_token` and optionally a `refresh_token` at Google's token endpoint.
05 Client uses the access_token in the `Authorization: Bearer` header to call Google APIs on behalf of the user.
POKE IT YOURSELF
curl -H "Authorization: Bearer $TOKEN" https://api.example.com/user — call an API with an OAuth2 token
curl -d "grant_type=authorization_code&code=..." https://auth.example.com/token — exchange code for a token
Drill this topic →
~90 sec read