OAuth
maang.io System Design Series
OAuth 2.0 lets an application act on your behalf without ever seeing your password — the "valet key" of the web, behind every "Sign in with Google/GitHub" button and virtually every major API. It issues scoped, revocable, expiring tokens instead of credentials. Layer OpenID Connect (OIDC) on top and it also becomes an authentication protocol. Understanding its flows, PKCE, and token validation is essential for any distributed-system or API design.
This deep dive comes in four parts:
- Foundations & Core Concepts — the roles, why OAuth exists, and tokens vs. authentication.
- Grants, PKCE & Tokens — the grant types, why PKCE is mandatory, and access vs refresh tokens.
- Advanced: OIDC & Validation — OpenID Connect, ID tokens, and JWKS-based token validation.
- Interview — Staff/Principal Q&A: flow selection, token security, and identity at scale.
OAuth — Part 2: OAuth2 Internals, Grant Types, PKCE & Token Mechanics
This chapter provides a comprehensive examination of OAuth 2.0 (RFC 6749) implementation patterns, focusing on the six standardized authorization grant types and their cryptographic security mechanisms. Part 1 established the foundational concepts; Part 2 explores the architectural considerations that determine grant type selection and the security properties that protect against common attack vectors.
Grant Type Selection Based on Security Constraints
OAuth 2.0 defines grant types as specific sequences of requests and responses between OAuth actors, each optimized for different application architectures and threat models.
Sign in to continue reading
The rest of this lesson is available with a free account. Signing in with Google or Microsoft is free.
Sign in to read the full lesson