{"head":{"title":"What Is OAuth 2.0? Plain-English Definition | OceanLab","description":"OAuth 2.0 lets an app get limited access to an account on another service without the user's password. How the flow works, an example and common mistakes.","canonical":"https://oceanlab.in/glossary/oauth"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"OAuth","path":"/glossary/oauth"}],"slug":"oauth","term":"OAuth 2.0","aka":["OAuth"],"category":"Identity and security","short":"A standard that lets an app get limited access to a user's account on another service, without ever seeing their password.","body":[["OAuth 2.0 is defined in IETF RFC 6749. When you click Connect your calendar, you are sent to the calendar provider, you log in there and approve a set of permissions called scopes. The provider then gives the app an access token that works only for those scopes, for a limited time."],["OAuth is about authorisation: what an app may do. It is often paired with OpenID Connect, a layer on top that adds identity, which is what Sign in with Google uses. For enterprise logins, ",{"href":"/glossary/saml","text":"SAML"}," is the other common standard."]],"why":["Any product that connects to other tools, such as calendars, CRMs, accounting software or payments, will use OAuth. It is also how your own API can let partners act for your users safely. Getting it wrong leaks tokens, which can be as bad as leaking passwords."],"example":["A sales tool needs to read a user's Gmail to log emails against deals. It asks only for read access to mail, stores the refresh token encrypted, and shows the user a page where they can disconnect at any time, which revokes the token."],"inBuild":["We use the authorisation code flow with PKCE for web and mobile apps, ask for the narrowest scopes, store tokens encrypted on the server and handle refresh and revoke from day one. Expired or revoked tokens show a clear reconnect message, not a silent failure."],"mistakes":[["Asking for broad scopes up front. Users refuse, and a leaked token can do more damage."],["Storing tokens in browser local storage where any injected script can read them."],["Treating an access token as proof of who the user is. That is what OpenID Connect is for."]],"related":[{"href":"/glossary/sso","label":"SSO (single sign-on)","detail":"One login, managed by an identity provider, that gives a person access to many separate apps."},{"href":"/glossary/saml","label":"SAML (Security Assertion Markup Language)","detail":"An open XML standard, SAML 2.0 from OASIS, that lets a company's identity provider vouch for a user when they log in to another app."},{"href":"/glossary/rbac","label":"RBAC (role-based access control)","detail":"An access model where permissions are attached to roles, and people get access by being given a role."},{"href":"/glossary/api-gateway","label":"API gateway","detail":"A single entry point that sits in front of a system's APIs and handles routing, auth and limits for every request."},{"href":"/glossary/webhook","label":"Webhook","detail":"An HTTP request one system sends to a URL you choose as soon as an event happens, so you do not have to keep asking."}],"tools":[{"href":"/tools/soc-2-checklist","label":"SOC 2 checklist","detail":"Free tool"}],"links":[{"href":"/pricing/categories/auth","label":"Auth pricing","detail":"Login and identity service prices, with sources."},{"href":"/software","label":"Software by industry","detail":"Systems we build per industry, with guides and tools."}],"sources":[{"title":"RFC 6749, The OAuth 2.0 Authorization Framework (IETF)","url":"https://datatracker.ietf.org/doc/html/rfc6749","checkedAt":"2026-10-25"}],"legal":false,"updatedAt":"2026-10-25"}