OAuthbased

OAuth-based refers to systems that implement OAuth 2.0 or later to grant third-party applications limited access to a protected resource on behalf of a resource owner. The primary goal is delegated authorization rather than authentication.

Key participants include the resource owner (user), the client (application requesting access), the authorization server (issues tokens), and the resource server (API or service hosting the protected resources). Access tokens carried in HTTP requests authorize access; tokens are bound by scope and optional audience.

Typical flow: the client directs the resource owner to the authorization server, the owner grants consent, the server issues an authorization grant, the client exchanges the grant for an access token (and optionally a refresh token); the client uses the access token to call the resource server. For public clients, the PKCE extension helps mitigate intercepted authorization codes.

While OAuth provides an authorization framework, it is not by itself an authentication protocol. OpenID Connect adds an identity layer on top of OAuth 2.0 to verify user identity and provide profile information.

Security considerations include using PKCE for public clients, always using HTTPS, employing short-lived access tokens and rotating refresh tokens, validating the token audience, implementing the state parameter to prevent CSRF, and ensuring redirect URIs are tightly validated. Additional binding mechanisms such as mutual TLS (mTLS) or DPoP can help tie tokens to clients.

Standards and variants: OAuth 2.0 is defined in RFC 6749; bearer tokens in RFC 6750; PKCE in RFC 7636. OAuth 2.1 consolidates best practices, and OpenID Connect is commonly used with OAuth to provide user authentication. OAuth-based deployments are widespread for API access, single sign-on, and third-party integrations.