Authentication & security

How does OAuth 2.0 authorization work?

OAuth 2.0 lets an application obtain limited access to another service without receiving the user's password. This explainer follows the common Authorization Code flow with PKCE used by browser and mobile applications.

Step-by-step

  1. 1

    Start authorization

    The client sends the user to the authorization server with the requested scope, redirect URI, state, and a PKCE code challenge.

  2. 2

    Authenticate and consent

    The authorization server authenticates the user and determines whether the requested permissions can be granted.

  3. 3

    Return an authorization code

    After approval, the browser is redirected back to the client with a short-lived authorization code and the client verifies the returned state.

  4. 4

    Exchange the code

    The client sends the authorization code and PKCE verifier to the token endpoint. The server checks that the verifier matches the original challenge.

  5. 5

    Receive scoped tokens

    The token endpoint issues an access token and, when the flow and policy allow it, may also issue a refresh token.

  6. 6

    Call the protected API

    The client presents the access token to the resource server, which validates the token and authorizes the requested operation according to its scopes and policy.

Keep learning

Related visual explainers

Web foundations7 steps

What happens when you enter a URL?

Opening a URL triggers a chain of work across the browser, DNS, network transport, TLS, HTTP, edge or origin servers, and finally the browser's rendering pipeline. Modern stacks can vary, but the core stages remain recognizable.

View explainer
AI systems6 steps

How do AI agents work?

An AI agent combines a model with instructions, state, tools, and a control loop. Instead of producing only one response, the system can choose an allowed action, execute it, observe the result, update state, and continue until it reaches a stopping condition.

View explainer