OAuth 2.0
Also called OAuth.
A standard that lets an app get limited access to a user's account on another service, without ever seeing their password.
Last updated
What it is.
OAuth 2.0 is defined in IETF RFC 6749. When you click Connect your calendar, you are sent to the calendar provider, you log in there and approve a set of permissions called scopes. The provider then gives the app an access token that works only for those scopes, for a limited time.
OAuth is about authorisation: what an app may do. It is often paired with OpenID Connect, a layer on top that adds identity, which is what Sign in with Google uses. For enterprise logins, SAML is the other common standard.
Why it matters
Any product that connects to other tools, such as calendars, CRMs, accounting software or payments, will use OAuth. It is also how your own API can let partners act for your users safely. Getting it wrong leaks tokens, which can be as bad as leaking passwords.
In a product build
We use the authorisation code flow with PKCE for web and mobile apps, ask for the narrowest scopes, store tokens encrypted on the server and handle refresh and revoke from day one. Expired or revoked tokens show a clear reconnect message, not a silent failure.
Common mistakes.
- 01
Asking for broad scopes up front. Users refuse, and a leaked token can do more damage.
- 02
Storing tokens in browser local storage where any injected script can read them.
- 03
Treating an access token as proof of who the user is. That is what OpenID Connect is for.
Read the official text.
Primary sources this definition is based on.
- RFC 6749, The OAuth 2.0 Authorization Framework (IETF)checked 2026-10-25
Work it out with a tool.
Related terms.
- SSO (single sign-on)One login, managed by an identity provider, that gives a person access to many separate apps.
- SAML (Security Assertion Markup Language)An open XML standard, SAML 2.0 from OASIS, that lets a company's identity provider vouch for a user when they log in to another app.
- RBAC (role-based access control)An access model where permissions are attached to roles, and people get access by being given a role.
- API gatewayA single entry point that sits in front of a system's APIs and handles routing, auth and limits for every request.
- WebhookAn HTTP request one system sends to a URL you choose as soon as an event happens, so you do not have to keep asking.
Guides and pages
Browse the full glossary or read answers to common questions.
