OAuth 2.0 RFC 6749: Standardizing Authorization for Web APIs

The API Authorization Crisis

Before OAuth, web applications secured APIs using custom tokens or required users to share their login passwords with third-party apps.

The finalization of RFC 6749 (The OAuth 2.0 Authorization Framework) in October 2012 provides a standardized authorization framework.

Core OAuth 2.0 Authorization Flows

OAuth 2.0 defines four authorization flows depending on application topology:

1. Authorization Code Grant

Used for server-side applications. The client redirects the user to the auth server, receives an authorization code, and exchanges it for an Access Token securely on the backend.

2. Implicit Grant

Used for client-side SPAs. The Access Token is returned directly in the browser redirect fragment, bypassing backend code integrations.

3. Client Credentials Grant

For machine-to-machine integrations.

Token-Based API Security

OAuth shifts API security to stateless token validation:

# Accessing secure API endpoints with OAuth tokens
curl -H "Authorization: Bearer my_access_token_abc" https://shivamitcs.in/api/profile

This standardizes API security, allowing SaaS platforms to authorize client access securely.