OAuth 2.0 overview in Rest API - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is OAuth 2.0?

OAuth 2.0 is a protocol that allows apps to access user data from another service securely without sharing passwords. It works by giving apps limited access tokens instead of full credentials.

beginner

Name the four main roles in OAuth 2.0.

The four main roles are: Resource Owner (user), Client (app requesting access), Authorization Server (issues tokens), and Resource Server (hosts protected data).

beginner

What is an access token in OAuth 2.0?

An access token is a special key given to an app after the user approves access. The app uses this token to get data from the resource server without needing the user's password.

intermediate

Explain the Authorization Code Grant flow in OAuth 2.0.

In this flow, the app redirects the user to the authorization server to log in and approve access. Then, the app gets a code it can exchange for an access token. This keeps the user's password safe.

beginner

Why is OAuth 2.0 better than sharing passwords between apps?

OAuth 2.0 lets users give apps limited access without sharing passwords. This reduces risk if an app is hacked and lets users control what data apps can see or change.

Which OAuth 2.0 role is responsible for issuing access tokens?

A Authorization Server

B Resource Owner

C Client

D Resource Server

The Authorization Server issues access tokens after verifying the user's approval.

What does an access token allow a client to do?

A Change the user's password

B Access protected resources on behalf of the user

C Authenticate the user directly

D Delete the user's account

Access tokens let the client access protected data without needing the user's password.

In OAuth 2.0, who is the Resource Owner?

A The server issuing tokens

B The app requesting access

C The user who owns the data

D The database storing data

The Resource Owner is the user who controls the data and grants permission.

Which OAuth 2.0 flow involves exchanging a code for an access token?

A Resource Owner Password Credentials Grant

B Implicit Grant

C Client Credentials Grant

D Authorization Code Grant

The Authorization Code Grant flow uses a code that the client exchanges for an access token.

Why should apps use OAuth 2.0 instead of asking for user passwords?

A To improve security by not handling passwords directly

B To make users enter passwords more often

C To store passwords in the app

D To avoid using tokens

OAuth 2.0 improves security by letting apps use tokens instead of passwords.

Describe the main roles involved in OAuth 2.0 and their responsibilities.

Think about who owns data, who asks for access, who grants tokens, and who holds the data.

Explain how the Authorization Code Grant flow works step-by-step.

Focus on the code the app gets before the token and why this is safer.