OAuth (Open Authorization) is an open standard protocol for secure, token-based authorization on the internet. It allows users to grant third-party applications limited access to their resources on another service without sharing their credentials. For example, when you sign into an app using your Google or GitHub account, OAuth is the protocol facilitating that secure handoff.
OAuth 2.0, the current version, defines several authorization flows (or grant types) suited to different scenarios, including the Authorization Code flow for server-side apps, the Implicit flow for single-page applications, and the Client Credentials flow for machine-to-machine communication. Each flow involves exchanging tokens between the client, the authorization server, and the resource server to verify identity and permissions.
OAuth is central to modern web and mobile application security. It powers the "Sign in with..." buttons seen across the web and enables API integrations between services. While OAuth handles authorization (what you can access), it's often paired with OpenID Connect (OIDC), which adds an authentication layer (who you are), providing a complete identity and access management solution.