Definition
OAuth 2.0 enables "Sign in with Google" or scoped API access — the user grants permission, the app receives a token, not the password.
OpenID Connect (OIDC) adds identity layers on top for authentication.
In simple terms
OAuth is a hotel key card — access to your room (data) for a limited time without handing over your house keys (password).
Where you see it
- Sign in with Google/GitHub on web apps.
- Third-party apps accessing Google Calendar with consent.
How it works
1.Redirect to provider
User logs in at Google, GitHub, etc.
2.Grant scopes
User approves what the app can access.
3.Exchange code
App trades authorization code for access token.
4.Call APIs
Token sent in Authorization header.
Why it matters
- OAuth is how modern apps handle login and delegated API access securely.
Often confused
OAuth is the same as authentication.
OAuth is authorization; OIDC or sessions handle who the user is.