OAuth 2.0 Authorization Flows

OAuth 2.0 Authorization Flows structure how permissions are brokered between the resource owner, client, and authorization server. They define roles, redirect/callback mechanisms, token artifacts, and state transitions to mitigate attacks such as code interception or token leakage. The concept is technology-agnostic yet primarily security-driven.

Use this profile to understand the building block briefly, place it in the model, and open related building blocks.

Content type

Concept

Theoretical construct: explains a term, principle, or mental model.

Classification level

Structure

What organizes, connects, or makes decisions possible.

Available perspectives

Open this building block directly in an already curated view.

Explain

In brief

OAuth 2.0 authorisation flows in brief

OAuth 2.0 is an authorisation framework that lets an application obtain limited access to protected resources without sharing the user’s password.

Where does it come from?

OAuth 2.0 grew from the problem of granting controlled access to services for third-party applications without sharing credentials. RFC 6749, published in 2012, formalised roles, tokens, and flows; later RFCs added security details.

The mental model

A person grants a client consent through an authorisation server. The client receives a limited access token and presents it to the resource server; roles and redirects require precise protection.

Key building blocks

Resource owner

This role can grant access to protected resources.

Authorisation code

A short-lived code is exchanged for a token through a protected back channel.

Scope

Scopes limit the permissions represented by a token.

When is it useful?

OAuth 2.0 separates delegated access from password handling and enables granular permissions. Redirect protection, PKCE, token lifetime, scope checks, and the distinction from authentication are key design concerns.

RFC 6749: OAuth 2.0 Authorization Framework

Why is this building block relevant?

Conceptual guidance for designing OAuth 2.0 authorization flows to securely delegate access.
Explains how clients request permissions via an authorization server, obtain grants, and use tokens—depending on application context and threat model.