What is OAuth?

OAuth 2.0 (RFC 6749, 2012) is a delegation protocol: it lets users grant a third-party app limited access to their resources WITHOUT sharing passwords.

"Login with Google" example:
1. User: I want to use this Photo App.
2. Photo App: I need to read your Google Drive.
3. User clicks "Allow on Google"
4. Google sends a TOKEN to Photo App.
5. Photo App uses the token to call Google APIs on user's behalf.

Key actors:

• Resource Owner (the user)
• Client (the third-party app, e.g., Photo App)
• Authorization Server (issues tokens, e.g., Google)
• Resource Server (hosts the data, e.g., Google Drive API)

(Authorization Server and Resource Server are often the same in practice — Google is both.)

OAuth 2.0 is NOT authentication. It's authorization (allowing access). For authentication ("who is this user?"), use OpenID Connect (OIDC), a layer on top of OAuth 2.0.

Common confusion: "Sign in with Google" is OIDC + OAuth. The OIDC part proves identity; the OAuth part lets the app access Google APIs.

What OAuth solves:

• Stop apps from storing your password
• Limit access ("only my photos, not my email")
• Revoke access without changing password
• Time-limited access (tokens expire)