OAuth 2.0 (RFC 6749) is the industry-standard authorization protocol that enables third-party applications to obtain scoped access to HTTP resources on behalf of a user.
OAuth 2.0 (RFC 6749) is an open-standard authorization framework that delegates user authentication to authorization servers. Rather than sharing user credentials with third-party applications, OAuth 2.0 issues short-lived cryptographically signed access tokens (such as JWTs) with granular scopes.
Inspect access tokens with our JWT Decoder, construct OAuth requests in the API Request Builder, or format query string parameters with the URL Encoder & Decoder.
| Specification | Details |
|---|---|
| RFC Standard | RFC 6749 (Core) & RFC 6750 (Bearer Token Usage) |
| Grant Types | Authorization Code with PKCE, Client Credentials, Refresh Token, Device Authorization |
| Token Formats | JSON Web Tokens (JWT), Opaque Bearer Tokens |
| Transport Layer | HTTPS / TLS 1.3 Mandatory |
| Standard Roles | Resource Owner, Resource Server, Client, Authorization Server |
| Companion Protocols | OpenID Connect (OIDC), OAuth 2.1 |
The standard flow for Single-Page Applications (SPAs) and mobile apps. The client generates a high-entropy cryptographic code_verifier and sends its SHA-256 hash (code_challenge) during authorization to prevent authorization code interception attacks.
Used for machine-to-machine (M2M) server communication where no human user is present. The microservice exchanges its client_id and client_secret directly for an access token.
Authorization servers issue short-lived access tokens (5–60 minutes) alongside single-use refresh tokens. When rotated, old refresh tokens are invalidated immediately to detect token replay attacks.
OAuth 2.0 is strictly an authorization protocol designed to grant access to APIs via access tokens. OpenID Connect (OIDC) is an identity layer built directly on top of OAuth 2.0 that provides authentication, issuing an id_token containing user identity claims alongside the API access token.
The Implicit Grant returned access tokens directly in the URL hash fragment, exposing tokens to browser history, referrer headers, and malicious scripts. Modern security standards mandate the Authorization Code Flow with PKCE instead.
Free, browser-based utilities to test, generate, and inspect OAuth 2.0 Authorization Framework payloads directly.
Decode, inspect, and validate JWT tokens with claim and signature analysis.
Encode and decode Base64 strings, files, and data URIs instantly.
Encode, decode, and parse URLs and query strings instantly.
Build and test HTTP API requests with headers, body, auth, and response visualization.
Generate secure passwords, passphrases, and PINs with real-time strength analysis.
