OAuth 2.0
OAuth enables limited access to protected resources. Permission to use an API does not automatically prove a signed-in person’s identity.
OAuth 2.0 is a framework for authorising access to protected resources. A service can receive an access token without being given the resource owner's personal password.
Limited permission
In a hypothetical example, a reporting service may read orders but may not change them. The granted rights and target resource limit what the token may be used for. The service accepting it must check those boundaries.
OAuth is not, by itself, a method for proving the identity of a signed-in person. Nor does merely possessing a token permit every action. A secure implementation needs current security guidance; older flow examples alone are insufficient.
Sources
Related terms
- APIAn API defines how software can use functions or data offered by other software.
- Identity and access managementIAM combines management of digital identities with their access rights. Accounts, role changes and removal of old permissions belong together.
- Least privilegeLeast privilege limits permissions to the required task and data scope. Necessary work remains possible while unnecessary powers are removed.
- WebAuthnWebAuthn is the browser API for public-key sign-in. The server must validate the browser response before accepting authentication.
- PasskeyA passkey enables sign-in with a service-bound key pair. Device changes, account recovery and account permissions remain separate responsibilities.
- Attribute-based access controlABAC evaluates access using defined properties and rules. The origin and freshness of those properties are part of the design.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.