OAuth enables secure third-party access to user resources without sharing passwords, forming the backbone of modern API security and single sign-on.
Why it matters
- Eliminates password sharing between applications, reducing credential exposure.
- Enables granular permission scopes, limiting what third-party apps can access.
- Required for enterprise identity federation and API ecosystem security.
- Foundation for modern authentication protocols like OpenID Connect (OIDC).
How it works
- Authorization Grant: User approves access via consent screen.
- Access Token: Short-lived credential for API requests.
- Refresh Token: Long-lived token to obtain new access tokens.
- Scopes: Define specific permissions (read email, access calendar).
- Authorization Server: Issues tokens after validating user consent.
Common OAuth flows
- Authorization Code Flow: Most secure, used for web and mobile apps.
- Client Credentials Flow: Service-to-service authentication.
- Implicit Flow: Legacy browser-based flow (deprecated).
- PKCE Extension: Protects authorization code flow from interception.
Security considerations
- Always validate redirect URIs to prevent token theft.
- Use PKCE for mobile and single-page applications.
- Implement token rotation and expiration policies.
- Monitor for unusual authorization patterns or scope requests.
Related Articles
View all articles
AI Agent Protocols Explained: MCP vs A2A vs ACP and the Agent Interoperability Stack
MCP and A2A are not rivals — they are complementary layers of the same stack: MCP connects an agent to tools and data, A2A connects agents to each other. Here is the whole interoperability landscape, with ACP, ANP, and AGNTCY put in their place.
Read article →
What Is the Model Context Protocol (MCP)? The USB-C Port for AI, Explained
Model Context Protocol (MCP) is the open standard — created by Anthropic in late 2024 — that lets any AI application connect to tools, data, and prompts through one uniform wire protocol. Here's how the host/client/server architecture, primitives, and transports actually work.
Read article →
What Is an MCP Server? How Model Context Protocol Servers Work (and How to Use One)
An MCP server is a small program that exposes tools, resources, and prompts to an AI app over a standard protocol. Here is what it actually does, local vs remote transports, a working config block, and how to add one to your AI coding CLI.
Read article →
MCP Security Risks: A Practical Threat Model for Teams Connecting AI Agents to Tools
MCP isn't uniquely unsafe, but every server you connect widens your attack surface. A risk catalogue, the trust model you're actually accepting, and the governance controls MSPs and security teams should put in place.
Read article →Explore More Identity & Access Management
View all termsAuthentication vs Authorization
Authentication verifies who you are, while authorization determines what you can do.
Read more →FIDO2
An open authentication standard that enables passwordless and phishing-resistant login using hardware security keys or platform authenticators.
Read more →Identity and Access Management (IAM)
The policies and technologies used to verify identities, govern permissions, and log access across systems.
Read more →Kerberos
A network authentication protocol that uses secret-key cryptography and trusted third parties to verify user and service identities without transmitting passwords.
Read more →LDAP (Lightweight Directory Access Protocol)
An open, vendor-neutral protocol for accessing and maintaining distributed directory services over a network.
Read more →Multi-Factor Authentication (MFA)
An authentication method that requires users to provide two or more verification factors to gain access.
Read more →