# What is OAuth 2.0?

> OAuth 2.0 is an authorization framework that lets a client obtain limited access to an HTTP service without receiving the resource owner’s credentials.

- Canonical URL: https://yellowcube.eu/glossary/oauth-2-0/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

An authorization server issues an access token that a resource server accepts under defined conditions. The client may act for a user after delegated authorization or on its own behalf in a machine-to-machine flow.

OAuth defines roles and protocol flows rather than one token format or universal permission model. For user-facing applications, current security practice favors the authorization-code flow with Proof Key for Code Exchange (PKCE). Implementations must bind responses to the correct client and redirect URI, protect authorization codes and refresh tokens, and ensure that access tokens are accepted only by their intended resource servers.

### Key points

- **Core roles:** Distinguish the resource owner, client, authorization server, and resource server; document when one component performs more than one role.
- **Token controls:** Constrain audience, scope, lifetime, and storage; validate tokens completely; rotate or revoke refresh tokens where appropriate; and avoid exposing bearer tokens in URLs or logs.
- **Current flow choices:** Follow the OAuth security best current practice: clients should not use the implicit grant except where its specified injection and leakage risks are mitigated, and must not use the resource owner password credentials grant.
- **Important limitation:** OAuth 2.0 does not define user authentication or prove who is using an access token. A valid token also does not replace object-, function-, or transaction-level authorization inside the resource server.

### Related terms

[Authorization](<https://yellowcube.eu/glossary/authorization/>) · [OpenID Connect (OIDC)](<https://yellowcube.eu/glossary/openid-connect/>) · [Authentication token](<https://yellowcube.eu/glossary/authentication-token/>) · [Application programming interface (API) security](<https://yellowcube.eu/glossary/application-programming-interface-security/>) · [API key](<https://yellowcube.eu/glossary/api-key/>)

### Sources

[RFC 6749: The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749) · [RFC 6750: OAuth 2.0 Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750) · [RFC 9700: Best Current Practice for OAuth 2.0 Security](https://datatracker.ietf.org/doc/html/rfc9700)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.