Key Takeaways
- OAuth 2.0 enables 'Sign in with Google/GitHub' by delegating authentication to trusted providers.
- PKCE (Proof Key for Code Exchange) is required for single-page apps and mobile apps. Never use Implicit Flow.
- OAuth handles authorization (what can you access). OpenID Connect (OIDC) adds authentication (who are you).
OAuth 2.0 Flows Explained
| Flow | Use Case | Security Level |
|---|---|---|
| Authorization Code + PKCE | SPAs, mobile apps | Highest (recommended for all new apps) |
| Authorization Code | Server-side web apps | High (requires server-side secret) |
| Client Credentials | Machine-to-machine APIs | High (no user involved) |
| Device Code | Smart TVs, CLI tools | Moderate (user authorizes on separate device) |
Security Warning
Never use the Implicit Flow (deprecated). Never store tokens in localStorage (XSS vulnerable). Use httpOnly cookies for token storage in web applications. Implement token refresh rotation to limit the impact of token theft.
Frequently Asked Questions
Related Services
Need Help With Implementation?
Our team specializes in implementing the solutions described in this glossary.
Get in Touch