What is OAuth?

OAuth (Open Authorization) is a secure authorization protocol that enables applications to obtain limited access to user resources on another service, without needing to handle or store the user’s credentials (like username and password). It serves as a critical layer in modern web and API security, enabling secure, delegated access via access tokens instead of raw credentials.

Originally designed for the social web, OAuth has evolved into a vital standard adopted by giants like Google, Microsoft, Facebook, Amazon, and others. It’s widely used in mobile apps, cloud services, enterprise systems, and Internet of Things (IoT) devices.

OAuth 2.0, the most common version, is not a strict authentication protocol by itself, but it enables secure authorization, often in combination with OpenID Connect (OIDC) for identity/authentication needs.

Major Use Cases of OAuth

OAuth is designed to serve a variety of real-world use cases across industries, technologies, and platforms. Here are the most common scenarios:

1. Third-Party App Access

OAuth allows users to grant limited access to their accounts on one site (like Google) to a third-party app (like Zoom) without sharing their credentials.

Example:
You use your Google account to sign into Spotify and grant Spotify access to your calendar or email address.

2. Single Sign-On (SSO)

OAuth is often combined with OpenID Connect to enable SSO solutions where users authenticate once and access multiple systems seamlessly.

Example:
An employee logs into their Microsoft account and gains access to Outlook, Teams, SharePoint, and internal enterprise apps without repeated logins.

3. API Access for Mobile or Web Apps

OAuth lets applications (mobile, desktop, browser-based) access RESTful APIs using tokens. This enables secure and stateless interactions without embedding credentials.

Example:
A mobile app accessing user profile data from an API server using an access token.

4. Server-to-Server Communication

For machine-to-machine use cases (like microservices or backend applications), OAuth’s Client Credentials Grant offers secure API communication without user involvement.

Example:
A payment gateway system authenticating backend services to process transactions via a banking API.

5. IoT and Smart Devices

OAuth allows headless devices like smart TVs, watches, or home assistants to securely connect and perform delegated tasks after user consent.

Example:
An Amazon Echo device linking to your Spotify account using the Device Authorization Flow.

How OAuth Works: Architecture Overview

OAuth defines interactions among several key roles and components. Here’s an architectural breakdown of how OAuth works:

Key Roles:

1. Resource Owner (User):
   The individual who owns the data and can grant access to it.
2. Client (Application):
   The app or service requesting access on behalf of the user (e.g., a weather app).
3. Authorization Server:
   Handles authentication and issues tokens (e.g., Google Auth, Okta, Auth0).
4. Resource Server:
   Hosts the protected resources and validates the token before allowing access (e.g., Gmail API, GitHub API).

Architecture Diagram:

[ User (Resource Owner) ]
           |
           v
[ Client Application ] ----> [ Authorization Server ]
           |                       |
           v                       v
[   Resource Server (API) <---- Access Token ]

OAuth Grant Types (Flows)

OAuth provides different flows tailored to various application types and use cases:

OAuth Workflow: Step-by-Step (Authorization Code Flow)

The Authorization Code Flow is the most common and secure flow. Here’s a step-by-step walkthrough:

Step 1: User Clicks “Login with…”

The client app redirects the user to the Authorization Server with a query string containing:

• Client ID
• Redirect URI
• Response type (code)
• Scopes (permissions requested)

Example URL:

https://authserver.com/auth?
  response_type=code&
  client_id=client123&
  redirect_uri=https://clientapp.com/callback&
  scope=profile email

Step 2: User Logs In and Grants Access

The user authenticates with the authorization server and approves or denies the request. If approved, they’re redirected to the client’s redirect URI with an authorization code.

Example redirect:

https://clientapp.com/callback?code=abc123

Step 3: Client Exchanges Code for Token

The client sends the authorization code along with its client ID and secret to the token endpoint to receive an access token and optionally a refresh token.

POST request to token endpoint:

POST /token
Host: authserver.com
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&
code=abc123&
redirect_uri=https://clientapp.com/callback&
client_id=client123&
client_secret=secret456

Step 4: Server Returns Access Token

The authorization server responds with a JSON object:

{
  "access_token": "eyJhbGciOiJIUzI1...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "tGzv3JOkF0XG5Qx2TlKWIA"
}

Step 5: Access Protected Resource

The client includes the access token in the HTTP header to access the API:

GET /userinfo
Host: api.example.com
Authorization: Bearer eyJhbGciOiJIUzI1...

Step 6: Refresh Token (Optional)

When the access token expires, the client can use the refresh token to get a new one without user interaction:

POST /token
grant_type=refresh_token&
refresh_token=tGzv3JOkF0XG5Qx2TlKWIA

Security Best Practices for OAuth

• Always use HTTPS to prevent token leakage.
• Store client secrets securely (never in browser/mobile code).
• Use short-lived tokens to reduce attack windows.
• Implement proper scope restrictions to enforce least privilege.
• Validate redirect URIs strictly to avoid phishing.
• Use PKCE (Proof Key for Code Exchange) in public clients like mobile apps.

DevOps is transforming how organizations across industries from banking to eCommerce to healthcare build and deliver cloud native applications. With DevOps, new application functionality can be delivered in rapid iterations and at scale, driving agile innovation to meet increasing customer demands and build competitive advantage.

A recent Harvard Business Review Analytic Services study found that roughly two-thirds of respondents use DevOps, and see benefits that impact their bottom line, including increased speed to market (identified by 70% of respondents), productivity (67%), customer relevance (67%), innovation (66%), and product/service quality (64%).

Using continuous integration methods (CI), developers merge code changes to a repository multiple times a day, which are automatically integrated into builds. Through continuous delivery (CD), code is always in a deployable state so it’s ready for release into production at the touch of a button.

As custom-built cloud applications are built and delivered using these agile DevOps practices, they rely on API access keys for dynamic connection to other applications and resources. Sometimes referred to as “API keys,” these powerful credentials are used to authenticate applications and DevOps automation tools and enable programmatic requests to the cloud environment. API keys can be used for virtually anything, from provisioning a container to copying a database to allowing one service to access data from another. Attackers have used API access keys — stolen from phished endpoints or inadvertently posted to public code repositories and other sources — to steal customer data and valuable intellectual property, or destructively delete source code.

Many of the DevOps tools used to orchestrate development and delivery of custom-built cloud applications are also highly privileged. For example, CI/CD tools for configuration management, such as Ansible, and those used to run automated tests and builds, like Jenkins. Since these “tier 0” tools enable full control of the environment, admin access must tightly controlled and restricted to reduce exposure.

Here are six steps for securing privileged access to custom-built cloud applications and in the DevOps pipeline where they’re created and deployed:

1. Remove all embedded API keys and secrets from source code, scripts and automation tools. DevOps culture emphasizes collaboration and code sharing. It’s common practice to post application code to GitHub and other public repositories. Yet too often, this code contains embedded API keys and other credentials and secrets, and attackers troll these repositories to locate and abuse them. Stay a step ahead by removing hard-coded credentials completely. Similarly, never provide human users with direct access to API keys.

2. Proactively secure all API keys and secrets in a secure digital vault that supports strong privileged access controls. Only allow access to authorized, verified users and applications under centralized, corporate-wide access policies.

3. Enforce least privilege access controls for all DevOps tools, including admin consoles as well as highly privileged human users. Follow strong privileged access management best practices, such as rotating privileged credentials and monitoring and recording privileged access activity for human and automated users.

4. Apply consistent, enterprise-wide security policies to the tools and admin consoles used at each specific stage of the DevOps pipeline: plan, code, build, test, release, deploy, operate, monitor.

5. Leverage single sign-on (SSO) and multi-factor authentication (MFA) to solve pervasive password challenges and strengthen Identity Security when granting DevOps access to any highly privileged human user.

6. Perform regular audits to identify gaps and privilege-related risk and to continuously improve overall security posture.

Consistency Is Key
The most effective cybersecurity programs enforce identity and privileged access policies consistently across their entire organization — regardless of infrastructure, application mix or development philosophy. This must be done at scale to keep pace as the organization and its cloud workloads evolve to support digital transformation and flexible work models. This can only be achieved from a centralized point of control that enables consistent management of privileged credentials, human and non-human identities, devices and secrets across multi-cloud and hybrid environments.