flâneur

Signing in with Google - OAuth 2.0 Simplified

oauth.com · 283 words · saved by 1 readers

Despite OAuth being an authorization protocol rather than an authentication protocol, it is often used as the basis for authentication workflows anyway. A typical use of many common OAuth APIs is just to identify the user at the computer when logging in to a third-party app. Authentication and authorization are often confused with each other, but can be more easily understood if you think about them from the perspective of an application. An app that is authenticating users is just verifying who the user is. An app that is authorizing users is trying to gain access or modify something that belongs to the user. OAuth was designed as an authorization protocol, so the end result of every OAuth flow is the app obtains an access token in order to be able to access or modify something about the user’s account. The access token itself says nothing about who the user is. There are several ways different services provide a way for an app to find out the identity of the user. A simple way is for

Signing in with Google - OAuth 2.0 Simplified 3 Despite OAuth being an authorization protocol rather than an authentication protocol, it is often used as the basis for authentication workflows anyway. A typical use of many common OAuth APIs is just to identify the user at the computer when logging in to a third-party app. Authentication and authorization are often confused with each other, but can be more easily understood if you think about them from the perspective of an application. An app that is authenticating users is just verifying who the user is. An app that is authorizing users is tr

related reading