Protocols
OAuth 2.0
An authorization framework that lets an application obtain limited access to a resource without handling the user's credentials.
What OAuth 2.0 means
OAuth 2.0 is an authorization framework, not an authentication protocol. It defines how an application obtains a token granting limited access to a resource — never who the user is. Conflating the two is the oldest mistake in the field, and the reason OpenID Connect exists.
Defined in: RFC 6749, with security guidance in the OAuth 2.0 Security Best Current Practice.
How it works
The framework defines several grant types for different situations. The authorization code grant is for applications acting on behalf of a user. The client credentials grant is for a service acting as itself, with no user involved. Others exist and several are now discouraged: the implicit grant returned tokens directly in a redirect URL, where they landed in browser history and referrer headers, and current guidance is not to use it.
The access token that results is a bearer token by default. Bearer means exactly what it says: whoever holds it may use it. There is nothing in a plain bearer token tying it to the client it was issued to, which is why token theft is the dominant attack and why sender-constraining mechanisms like DPoP exist.
Scopes bound what a token may do. They are coarse by design — an authorization framework cannot express every application's permission model — so most systems still need their own authorization layer behind the token. A scope is a boundary, not a policy.
The mistake people actually make
Treating a successful OAuth flow as proof of identity. It proves the user authorized your application at a provider. Without an ID token or a verified userinfo call, it says nothing verifiable about who they are.
Related terms
OpenID Connect (OIDC)
An identity layer on top of OAuth 2.0 that lets an application verify who a user is, not just what it may access.
PKCE
Proof Key for Code Exchange — binds an authorization code to the client that requested it, so a stolen code is useless.
Access token
A credential presented to an API to prove the caller is authorized, typically short-lived.
Client credentials grant
The OAuth 2.0 grant where a service authenticates as itself, with no user involved.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.