OAuth 2.0

OAuth 2.0 is the internet's standard framework for delegated authorisation, granting apps scoped, expiring access tokens instead of passwords.

OAuth 2.0 is the internet's standard framework for delegated authorisation: a user grants an application limited access to resources held elsewhere ("this app may read my account data") without sharing credentials. The application receives a scoped, expiring access token from the authorisation server and presents it to the resource API.

OAuth deliberately does authorisation, not authentication - knowing you may access something is not knowing who you are. OpenID Connect adds the identity layer on top. In our domain OAuth flows carry remote signing authorisation in the CSC API, PSD2 account access, and credential issuance in OpenID4VC.

OAuth 2.0 is standardised in IETF RFC 6749. Current deployments should use the authorisation code flow with PKCE as the default flow; the older implicit and resource owner password credentials grants are deprecated and should not be used in new applications, as reflected in the OAuth Security Best Current Practice and the emerging OAuth 2.1 specification.