What is an OAuth 2.0?

OAuth 2.0 replaced the more complex, signature-based OAuth 1.0a with a simpler model built around bearer tokens exchanged over TLS. It defines distinct grant types for different clients: the authorization code grant (the most common, used by server-side web apps, ideally paired with PKCE for public clients like mobile and single-page apps), the client credentials grant (for pure machine-to-machine access with no end user), and the device authorization grant (for input-constrained devices). Tokens issued are typically short-lived access tokens paired with a longer-lived refresh token that lets the app silently obtain a new access token without the user re-authenticating. OAuth 2.0 by itself only handles authorization, granting access to resources, and deliberately does not define how to verify a user's identity, which is why OpenID Connect was layered on top of it to add a standardized identity and authentication layer. A common real-world mistake is treating a successful OAuth 2.0 token exchange as proof of who the user is, when OAuth 2.0 alone only proves that some access was granted, not who granted it.