OAuth 2.0
frameworkOAuth 2.0 is an authorisation framework that lets a client obtain limited access to protected resources without requiring the resource owner to share credentials with that client.
Technical explanation
OAuth separates the resource owner, client, authorisation server, and resource server. The client receives scoped access tokens through an appropriate grant flow. Modern deployments use exact redirect-URI validation, state protection, PKCE, short-lived tokens, secure client authentication where applicable, and constrained scopes.
Business relevance
OAuth enables delegated access among web, mobile, API, and partner applications while reducing password sharing and supporting revocable, least-privilege permissions.
Implementation example
A reporting application requests read-only access to selected CRM data. The user authorises the scope, and the application receives a limited token rather than the user’s CRM password.
Limitations and common misconceptions
OAuth is primarily for authorisation, not user authentication; OpenID Connect adds an identity layer. Misconfigured redirects, excessive scopes, token leakage, and unsuitable flows can undermine security.
Discuss your systems
Need help implementing or evaluating this concept? Keenfunnel designs connected AI, automation, and data systems.
Book a discovery session