OAuth 2.0

OAuth 2.0 Authorization Framework implementation with PKCE support

Start with Recommended FlowRecommended Flow Open Looking Glass

Available Flows

Authorization Code Flow

The standard OAuth 2.0 flow for server-side applications with a confidential client (RFC 6749 §4.1). The authorization code is exchanged server-to-server, keeping access tokens away from the browser.

Server-side AppsConfidential ClientsClient Secret

View flow diagram

Authorization Code + PKCE

OAuth 2.0 Authorization Code flow with Proof Key for Code Exchange (RFC 7636). PKCE protects public clients (SPAs, mobile apps) that cannot securely store a client secret. It prevents authorization code interception attacks even if the code is stolen.

Single Page AppsMobile AppsNo Client Secret

View flow diagram

Client Credentials Grant

Machine-to-machine (M2M) authentication for confidential clients (RFC 6749 §4.4). Client authentication (client_secret_basic or RFC 7523 private_key_jwt) and access-token protection (Bearer or RFC 9449 DPoP) are independent choices exposed in one executable flow.

Client Auth ChoiceBearer or DPoPNo User Context

View flow diagram

Refresh Token Flow

Obtain new access tokens without user interaction using a refresh token (RFC 6749 §6). Refresh tokens are long-lived credentials that allow the client to maintain access after the access token expires.

Token RotationLong SessionsSilent Refresh

View flow diagram

Token Introspection (RFC 7662)

Allows a Resource Server to query the Authorization Server about the current state of an access token. Returns metadata including whether the token is active, its scopes, subject, and expiration. Essential for opaque tokens and revocation checking.

View flow diagram

Token Revocation (RFC 7009)

Invalidate access or refresh tokens before their natural expiration. Essential for logout flows and security incident response. Supports both access and refresh token revocation.

View flow diagram

Specs & references

Authoritative reading list for OAuth 2.0 — core specs, security considerations, and companion standards.

Core specs

· The specifications that define this protocol.

Security & privacy

· Dedicated security and privacy considerations.

Companion specs

· Extensions, hardenings, and supporting RFCs.

OAuth 2.0 Features

Authorization Code Flow

Standard flow for server-side applications

PKCE for Public Clients

Enhanced security for SPAs and mobile apps (RFC 7636)

Client Credentials

Machine-to-machine authentication