GLOSSARY

An authorisation framework that lets a client obtain limited access to protected resources without requiring the resource owner to share credentials with that client.

OAuth enables delegated access among web, mobile, API, and partner applications while reducing password sharing and supporting revocable, least-privilege permissions.

A reporting application requests read-only access to selected CRM data. The user authorises the scope, and the application receives a limited token rather than the user’s CRM password.

OAuth is primarily for authorisation, not user authentication; OpenID Connect adds an identity layer. Misconfigured redirects, excessive scopes, token leakage, and unsuitable flows can undermine security.

OAuth separates the resource owner, client, authorisation server, and resource server. The client receives scoped access tokens through an appropriate grant flow. Modern deployments use exact redirect-URI validation, state protection, PKCE, short-lived tokens, secure client authentication where applicable, and constrained scopes.