Glossary

OAuth 2.0

OAuth 2.0 is an authorisation protocol that lets an application obtain limited access to a user's resources on another service — without sharing the user's password. "Sign in with Google" is OAuth 2.0.

Main roles

Resource Owner — the user who owns the data
Client — your application requesting access
Authorization Server — the server (Google, GitHub) that issues tokens
Resource Server — the API that holds the user's data

Flows (Grant Types)

Authorization Code + PKCE — most secure; for web and mobile apps
Client Credentials — for machine-to-machine communication (no user involved)
Implicit — deprecated, not recommended

OAuth vs OpenID Connect

OAuth 2.0 provides authorisation (access to a resource). OpenID Connect (OIDC) is a layer on top of OAuth that adds authentication (who you are). OIDC returns an ID Token (JWT) containing user data.