OAuth
OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
Software Security for Developers
OAuth is an authorization framework that enables delegated access to protected resources without sharing the resource owner's credentials with the resource server.
- How it is used
- Delegates authentication and protected-resource authorization to an identity provider across web, mobile, and service applications.
- How deep it goes
- Explains actors, grant types, tokens, PKCE, and refresh-token handling, while deferring complete protocol implementation details.
- Examples
- Uses employee SSO, social login, authorization-code flows, client credentials, JWTs, PKCE, and refresh-token scenarios.
- What you can do after
- Apply OAuth 2.0 and OIDC flows to design delegated access, SSO, token validation, and safer user sessions.
Authorization in Action
OAuth 2.0 is an open authorization framework that lets applications obtain limited delegated access to protected resources without exposing a user's credentials.
- How it is used
- Enables third-party applications to obtain limited, revocable access to protected APIs without receiving user passwords.
- How deep it goes
- Defines delegation roles, scopes, two grants, token validation, and Cedar-based runtime enforcement rather than OAuth internals.
- Examples
- Illustrates BI Explorer reading Kate’s workspace metadata and a Task App performing background task synchronization.
- What you can do after
- Apply it via OAuth tokens and scopes with Cedar policies to authorize external API requests at a gateway.
.NET MAUI in Action
OAuth is an authorization framework that allows an application to obtain delegated access to protected resources without receiving the user's password.
- How it is used
- Authenticates .NET MAUI users through a browser and obtains tokens for protected API calls.
- How deep it goes
- Walks through OIDC client configuration, browser callbacks, platform URL registration, and token attachment; defers broader identity topics.
- Examples
- Uses an IdentityServer-backed MAUIStockTake app with LoginAsync, a custom callback URL, AuthBrowser, and AuthService.
- What you can do after
- Apply it via WebAuthenticator and OidcClient to sign in users and attach access tokens to HTTP requests.
ASP.NET Core in Action, 3e
OAuth 2.0 is an authorization protocol that lets a resource owner delegate controlled access to protected resources without revealing credentials to the accessing service.
- How it is used
- Delegates controlled access from a resource owner to another application without exposing credentials.
- How deep it goes
- Explains the authorization-code sequence and grant-type choices, but stops short of protocol internals or implementation code.
- Examples
- Uses dogphotos.com accessing Facebook photos through redirects, consent, an authorization code, and delegated access.
- What you can do after
- Evaluate authorization flows and choose interactive or machine-to-machine grants for API access scenarios.
Acing the CCNA Exam: Volume 2 Advanced Networking and Security
OAuth 2.0 is an industry-standard authorization framework that delegates controlled access to protected resources without sharing the resource owner's credentials with a third-party application.
- How it is used
- Delegates third-party access to protected REST API resources on a user’s behalf without sharing the user’s credentials.
- How deep it goes
- Explains the basic authorization sequence and its participants, but does not detail specific grant types or implementation configuration.
- Examples
- Uses a process diagram showing a client obtaining delegated access to a resource owner’s protected resource.
- What you can do after
- Apply it to understand how a client obtains an access token and uses delegated authorization to access protected API resources.
Read how Acing the CCNA Exam: Volume 2 Advanced Networking and Security explains OAuth →
Secure APIs
OAuth 2.0 is the earlier major version of the OAuth authorization framework that defined multiple authorization flows for delegated access.
- How it is used
- Delegates limited API access to web, mobile, and programmatic clients without sharing user passwords.
- How deep it goes
- Explains roles, scopes, tokens, and four flows, then adds PKCE and sender-constrained-token protections without implementation code.
- Examples
- Uses a job portal importing LinkedIn employment history and identifies microservices and smart TVs as flow-selection scenarios.
- What you can do after
- Apply OAuth by selecting a flow, requesting scopes, and using time-limited access tokens for delegated API access.
Spring Security in Action, Second Edition
OAuth 2 is an authorization framework specification for delegated access to protected resources using access tokens.
- How it is used
- Uses delegated access tokens to authorize clients against protected resources and to authenticate Spring applications through external providers.
- How deep it goes
- Explains actors, token categories, grant types, PKCE, refresh tokens, and Spring configuration, without detailing protocol message exchanges.
- Examples
- Demonstrates external-provider login, custom provider URIs, opaque-token introspection, client credentials, and Spring Security client managers.
- What you can do after
- Apply OAuth 2 through Spring Security for external login and backend-to-backend access-token requests.
Read how Spring Security in Action, Second Edition explains OAuth →
Spring in Action, Sixth Edition
OAuth 2 is an authorization framework that enables a client to obtain limited access to protected resources on behalf of a resource owner.
- How it is used
- Secures REST APIs with limited, token-based trust and supports third-party sign-in through OAuth 2 or OpenID Connect.
- How deep it goes
- Explains authorization servers, resource servers, access tokens, scopes, and Spring configuration without detailing protocol internals.
- Examples
- Uses valet keys, Taco Cloud Facebook sign-in, client scopes, protected routes, and Spring OAuth2 client configuration.
- What you can do after
- Configure Spring Security OAuth2 clients and understand how authorization servers and resource servers protect API requests.
Building Distributed Applications that Work
OAuth is an authorization framework that enables clients to obtain limited access to protected resources without handling the resource owner's credentials.
- How it is used
- Provides authorization alongside OIDC authentication in an IdP-backed single sign-on flow.
- How deep it goes
- Defines OAuth's authorization role and sketches token-based sessions, but defers protocol details.
- Examples
- Uses an administrator-only page and an online shop whose accounts and orders require protection.
- What you can do after
- Evaluate/understand where authorization fits when securing access to an IdP-backed application.
Read how Building Distributed Applications that Work explains OAuth →
Related concepts
- openid connectused by · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
- API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
- scopeuses · Scope is a defined boundary specifying which entities, activities, resources, or conditions are included or governed in a particular context.
- authenticationuses · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
- authorization code flowhas part · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
- resource serverhas part · A resource server is a service that hosts protected resources, validates access credentials such as tokens, and enforces authorization for client requests.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.