How OAuth Works
"Log in with Google" — without Google ever seeing the other site's password.
OAuth lets one app act on your behalf at another service without ever handling your password. Instead of credentials, apps get a scoped, revocable token.
A
🧑
You + App
B
🔐
Provider
1Redirect to provider
2You approve scopes
3Provider returns a code
4App swaps code for token
Legend — how to read this diagram
A · BPartiesthe two sides of the exchange
1–nOrdereach message, numbered in sequence
1 2 3Walkthroughnumbered steps below run in order
The authorization-code flow
- Redirect. The app sends you to the provider with the scopes it wants.
- Consent. You authenticate with the provider and approve (or deny) those scopes.
- Code. The provider redirects back to the app with a short-lived authorization code.
- Token exchange. The app's server swaps the code (plus its secret) for an access token.
- Use & refresh. The app calls APIs with the token, refreshing it as needed.
Why it's safer than sharing a password
Scoped. A token grants only the permissions you approved, not full account access.
Revocable. You can revoke one app without changing your password.
PKCE. Public clients add a proof step so an intercepted code alone is useless.
One-line mental model:
Hand out a narrow, revocable token — never the password itself.
No comments:
Post a Comment