What is OAuth 2.0?

OAuth 2.0 is an authorisation framework that lets an application access a user's data on another service without handling their password, by exchanging a scoped access token. It authorises; it does not authenticate.

An authorization framework that allows applications to obtain limited delegated access to user accounts on third-party services without requiring users to share their passwords. OAuth 2.0 underpins most modern single sign-on and API authorization flows. Common OAuth vulnerabilities, including open redirect exploitation, missing state parameter validation, authorization code interception, and token leakage via referrer headers, are a frequent focus of web application security assessments.

Related terms