Digital Lexicon Hub

An authorization framework that lets a client obtain limited access to protected resources without requiring the resource owner to share credentials with that client.

OAuth enables delegated access among web, mobile, API, and partner applications while reducing password sharing and supporting revocable, least-privilege permissions.

A reporting application requests read-only access to selected CRM data. The user authorizes the scope, and the application receives a limited token rather than the user's CRM password.

OAuth is primarily for authorization, not user authentication; OpenID Connect adds an identity layer. Misconfigured redirects, excessive scopes, token leakage, and unsuitable flows can undermine security.

OAuth separates the resource owner, client, authorization server, and resource server. The client receives scoped access tokens through an appropriate grant flow. Modern deployments use exact redirect-URI validation, state protection, PKCE, short-lived tokens, secure client authentication where applicable, and constrained scopes.