OAuth
maang.io System Design Series
OAuth 2.0 lets an application act on your behalf without ever seeing your password — the "valet key" of the web, behind every "Sign in with Google/GitHub" button and virtually every major API. It issues scoped, revocable, expiring tokens instead of credentials. Layer OpenID Connect (OIDC) on top and it also becomes an authentication protocol. Understanding its flows, PKCE, and token validation is essential for any distributed-system or API design.
This deep dive comes in four parts:
- Foundations & Core Concepts — the roles, why OAuth exists, and tokens vs. authentication.
- Grants, PKCE & Tokens — the grant types, why PKCE is mandatory, and access vs refresh tokens.
- Advanced: OIDC & Validation — OpenID Connect, ID tokens, and JWKS-based token validation.
- Interview — Staff/Principal Q&A: flow selection, token security, and identity at scale.