Backend & systems·Security and identity
the user grants your app access to their data on another service without ever giving you their password.
OAuth 2.0
Also calledauthorization code flow, delegated authorization
A delegated authorisation framework: a resource owner authorises a client to access an API on their behalf, and the client receives a token rather than credentials. It is authorisation, not authentication — the token says what you may do, not who you are. Using it for login is what OpenID Connect exists to fix.