Security · interactive
OAuth: the authorization code flow
“Sign in with Google” or “Allow this app to read your calendar”: OAuth lets an app act for a user without ever seeing their password. The user approves at the provider, the app gets a short-lived code, and swaps it for tokens. PKCE stops a stolen code being useful.
User's browser → Your app
Sign in with Acme
The user clicks “Sign in”. The app never sees their password.
Scenario
Redirect to the provider
The app asks for specific scopes and sends a random state to stop forged callbacks.
The password is only typed at the provider.
A code comes back in the URL
Short-lived and single-use. URLs leak (history, logs, other apps), so the code alone shouldn't be enough.
Check state before anything else.
Swap the code for tokens, with proof
PKCE: the app sent a hash of a secret at the start and reveals the secret now. Only the app that began the flow can finish it.
code_challenge = BASE64URL(SHA256(verifier))
Short access, long refresh
Access tokens expire in minutes; refresh tokens get new ones and can be revoked. OIDC adds an ID token saying who the user is.
Use PKCE for every client, not just mobile.
In production
Tools and technologies
OAuth and OIDC power every “Sign in with…” button.
Not tied to one language — use these names when you search docs or design a system.