|$ curl https://forge-ai.dev/api/markdown?path=docs/security/oauth2
$cat docs/oauth-2.0.md
updated Recently·24 min read·published
OAuth 2.0
Introduction
OAuth 2.0 is an authorization framework that lets users grant third-party applications limited access to their resources without sharing passwords. OpenID Connect (OIDC) builds on OAuth 2.0 to add authentication (identity).
Roles
| Role | Description |
|---|---|
| Resource Owner | The user who owns the data |
| Client | The application requesting access |
| Authorization Server | Issues tokens after authenticating the user |
| Resource Server | Hosts the protected APIs |
PKCE
Proof Key for Code Exchange (PKCE) protects public clients (mobile apps, SPAs) from authorization code interception. The client generates a secret verifier, sends a hashed challenge, and later proves possession of the verifier during token exchange.
✓
best practice
Always use PKCE for mobile and single-page apps. Modern OAuth 2.1 makes PKCE mandatory for all clients.
Tokens
| Token | Purpose | Lifetime |
|---|---|---|
| Access Token | Authorize API requests | Short (minutes to hours) |
| Refresh Token | Obtain new access tokens | Long (days to months) |
| ID Token | Prove user identity (OIDC) | Short |
Security Considerations
- Use HTTPS everywhere.
- Store tokens securely; never expose refresh tokens in browsers.
- Validate state parameter to prevent CSRF.
- Use exact redirect URI matching.
- Request the minimum scopes necessary.