What it means
OAuth is a way for a person or service to let a client call an API without handing that client a password. An authorization server issues an access token. The client presents the token to a resource server. The resource server checks the token and allows only the action that token is good for. A scope name is a request, not a guarantee. The API still has to enforce it.
An access token is not an identity card. It does not, by itself, tell you which human approved the grant, and it does not authorize every method on the API. A token minted for one client or one audience must not be accepted by another. Expiration, revocation, and the refresh path are part of the control, because a token that lives forever becomes a password you cannot rotate.
AN ILLUSTRATIVE SCENARIO
TrackPort connects a calendar
Riverstone lets dispatchers show delivery windows in a calendar product. The connector receives an access token whose requested scope is read-only windows for assigned routes. Maya checks that TrackPort’s API refuses that token when the connector asks for the customer-address export. The token can be valid, unexpired, and still unauthorized for that action. When a dispatcher leaves, the team revokes the grant and confirms the connector cannot refresh it.
Put it to work
- Name the client, the authorization server, the resource server, the audience, and the scopes you intend to allow. Write the actions the token must not perform.
- Validate issuer, audience, expiry, and signature with a maintained library. Enforce the allowed action in the API, not only in the consent screen.
- Test a happy call, a call outside the scope, a token for a different audience, and revocation. Record how refresh and connector offboarding work.
How to check your work
Call the allowed API and the export API with the same test token. Only the allowed call succeeds. Repeat with an expired token and a token issued to a different client, and confirm both fail.
Connect the ideas
- Federation
Trusting authentication assertions from an external identity provider instead of storing every password locally.
- SSO
A pattern where one authentication to an identity provider is reused across multiple applications.
- Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.
- Authentication
The act of verifying a claimed identity with authenticators such as passwords, passkeys, or certificates.