Glossary · Web & App Development
OAuth 2.0
Overview
What OAuth 2.0 is
OAuth 2.0 is the industry-standard framework for delegated authorization, defined in RFC 6749. It solves a specific problem: letting one application act on a user's behalf against another service's API without the user handing over their username and password.
Importantly, OAuth 2.0 is an authorization protocol, not an authentication one. It answers 'what is this app allowed to do?' rather than 'who is this user?' — authentication layers like OpenID Connect are built on top of it for login.
How it works
Instead of sharing credentials, the client application obtains an access token — a scoped, time-limited credential — from an authorization server after the resource owner (the user) approves the request. The client then presents that token to the resource server (the API) to access only the data the scopes permit.
OAuth 2.0 defines several grant types (flows) for different scenarios: the Authorization Code flow with PKCE for web and mobile apps, Client Credentials for machine-to-machine access, and others. Tokens can be refreshed and revoked without exposing the user's password.
Why it matters
OAuth 2.0 underpins nearly every 'Connect your account' and 'Sign in with Google/Microsoft/GitHub' experience, plus most API integrations between SaaS products. It limits blast radius: a leaked token is scoped and expiring, and users can revoke access without changing their password.
When building integrations, follow current best practice — the Authorization Code flow with PKCE, short-lived access tokens, and secure refresh-token handling. The older Implicit and Password grants are now discouraged. Providers like Auth0, Clerk, and Firebase implement these flows so teams don't build them from scratch.
Where we use it
Related Zen in Tech services
How our team puts OAuth 2.0 to work in real projects.
FAQ
OAuth 2.0 — common questions
Is OAuth 2.0 authentication or authorization?
OAuth 2.0 is an authorization framework — it grants an app permission to access resources on a user's behalf. Authentication (verifying who the user is) is handled by OpenID Connect, a layer built on top of OAuth 2.0.
What is an access token in OAuth 2.0?
An access token is a scoped, time-limited credential issued by the authorization server that a client presents to an API to access a user's resources. It replaces sharing the user's actual password.
What is the difference between OAuth 2.0 and JWT?
OAuth 2.0 is a framework for delegating access; JWT is a token format. OAuth access tokens are often (but not always) JWTs. In short, OAuth defines the flow, while JWT can be how the token itself is encoded.
Need OAuth 2.0 done right?
Book a free consultation and we’ll map the fastest, most cost-effective path for your project.
Knowledge hub
From our knowledge hub
All articles →How to Reduce AI Voice Agent Latency
How to cut AI voice agent latency to sub-second, human-like turn-taking: where lag comes from (STT, LLM, TTS, network) and the fixes that actually work.
Read · 7 min →AI AutomationAutomating Lead Follow-Up and Onboarding for Coaches and Agencies
Follow-up automation for coaches and agencies: respond to leads in minutes, qualify prospects before calls, and automate onboarding so you focus on clients.
Read · 6 min →Web DevelopmentThe Auto Repair & Dealership Website That Books More Jobs
Auto repair and dealership websites that convert: online booking, fast mobile pages, reviews, and service pages that turn visitors into booked jobs.
Read · 4 min →