OAuth 2.0 — Complete Tutorial
Every concept worth learning to understand OAuth 2.0 end to end, grouped into six stages and explained in one short line each.
1Foundations
Start here — the vocabulary and mental model everything else builds on.
01 – What OAuth 2.0 Is (and Isn’t)
An authorization framework for granting limited access — not a login system on its own. That distinction shapes everything else.
02- The Four Roles
Resource Owner (user), Client (app), Authorization Server (issues tokens), Resource Server (holds the data).
03 – OAuth 2.0 vs OpenID Connect vs SAML
OAuth handles authorization; OpenID Connect adds identity on top of it; SAML is an older, XML-based identity standard used mostly in enterprise SSO.
2Core Building Blocks
The pieces every flow is assembled from.
04 – Access Tokens
A short-lived credential sent with API requests to prove the client has permission to act.
05 – Refresh Tokens
A long-lived credential used to get a new access token silently, without asking the user to log in again.
06 – ID Tokens (OpenID Connect)
A JWT that proves who the user is — belongs to OpenID Connect, not core OAuth, and should never be used as an API access credential.
07 – Scopes
Named permissions (like photos.read) that keep a client’s access narrow and visible to the user at consent time.
08 – Client ID and Client Secret
The credentials that identify an application itself to the authorization server, separate from any user’s credentials.
09 – Confidential vs Public Clients
Confidential clients (backend servers) can safely hold a secret; public clients (mobile apps, SPAs) can’t, which is why PKCE exists.
3Grant Types (Flows)
The different “recipes” for obtaining a token, each suited to a different kind of client.
10 – Authorization Code Grant
The standard flow for apps with a login page — a code is exchanged server-to-server for tokens.
11 – PKCE (Proof Key for Code Exchange)
An add-on to the Authorization Code grant that protects clients which can’t hold a secret, such as mobile and single-page apps.
12 – Client Credentials Grant
Used for server-to-server, machine-to-machine access where no human user is involved.
13 – Device Authorization Grant
Lets input-limited devices like smart TVs display a code the user approves on a separate phone or laptop.
14 – Refresh Token Grant
Trades a refresh token for a new access token once the old one expires.
15 – Implicit GrantLegacy
Returned tokens directly in the browser URL; deprecated because that exposed tokens to history and referrer leaks.
16 – Resource Owner Password Credentials GrantLegacy
Let a client collect the user’s password directly; deprecated because it defeats OAuth’s core purpose.
4Protocol Mechanics
The moving parts that make the flows actually work under the hood.
17 – Redirect URIs
The pre-registered address the authorization server is allowed to send the user and code back to.
18 – The state Parameter
A random value the client checks on return to protect against cross-site request forgery.
19 – Authorization Endpoint vs Token Endpoint
The authorization endpoint handles user login and consent; the token endpoint issues the actual tokens.
20 – JWT (JSON Web Token) Structure
The header-payload-signature format most access and ID tokens are encoded in.
21 – Token Introspection and Revocation
Endpoints that let a resource server check if a token is still valid, or let a user/client invalidate one early.
5Security
What separates a correct implementation from an exploitable one.
22 – Token Storage Best Practices
Where and how tokens are kept — cookies, local storage, or secure device storage — changes what an attacker can steal.
23 – Common Attacks
Authorization code interception, open redirects, token replay, and CSRF are the recurring threats to design against.
24 – Token Expiry and Rotation Strategy
Deciding how long tokens live and how refresh tokens rotate to limit damage from a leak.
6Practical / Advanced
Where OAuth 2.0 shows up in real, larger systems.
25 – Consent Screens and Scope Negotiation
How the user sees and approves (or partially approves) the scopes an app is requesting.
26 – Single Sign-On (SSO) with OAuth/OIDC
Using one login session across multiple applications, built on top of OpenID Connect.
27 – Multi-Tenant and Enterprise OAuth Setups
Handling multiple organizations or customer accounts under one authorization server.
28 – Rate Limiting and API Gateway Integration
How gateways validate tokens and throttle requests before they ever reach the resource server.