Chapter 1. What is OAuth 2.0 and why should you care?

If you’re a software developer on the web today, chances are you’ve heard of OAuth. It is a security protocol used to protect a large (and growing) number of web APIs all over the world, from large-scale providers such as Facebook and Google to small one-off APIs at startups and inside enterprises of all sizes. It’s used to connect websites to one another and it powers native and mobile applications connecting to cloud services. It’s being used as the security layer for a growing number of standard protocols in a variety of domains, from healthcare to identity, from energy to the social web. OAuth is far and away the dominant security method on the web today, and its ubiquity has leveled the playing field for developers wanting to secure their applications.

But what is it, how does it work, and why do we need it?

1.1. What is OAuth 2.0?

1.2. The bad old days: credential sharing (and credential theft)

1.3. Delegating access

1.4. OAuth 2.0: the good, the bad, and the ugly

1.5. What OAuth 2.0 isn’t

1.6. Summary