OAuth 2.0 overview in Rest API - Step-by-Step Execution

Concept Flow - OAuth 2.0 overview

User wants to access resource

↓

Client requests authorization

↓

Authorization Server authenticates user

↓

User grants permission

↓

Authorization Server issues access token

↓

Client uses token to access resource

↓

Resource Server validates token and serves data

↓

End

This flow shows how a user authorizes a client app to access resources securely using tokens.

Execution Sample

Rest API

GET /authorize?client_id=abc&response_type=code HTTP/1.1
Host: auth.example.com

User logs in and grants access

Response: Authorization code

POST /token HTTP/1.1
Host: auth.example.com
Content-Type: application/x-www-form-urlencoded

code=authorization_code&grant_type=authorization_code&client_id=abc&client_secret=secret

GET /resource HTTP/1.1
Authorization: Bearer access_token

This example shows the main HTTP steps in OAuth 2.0: authorization request, token exchange, and resource access.

Execution Table

Step	Action	Request/Response	Result
1	Client requests authorization	GET /authorize?client_id=abc&response_type=code	Authorization server shows login and consent
2	User authenticates and grants permission	User submits login and consent form	Authorization server issues authorization code
3	Client exchanges code for token	POST /token with code	Authorization server returns access token
4	Client accesses resource	GET /resource with Authorization: Bearer token	Resource server validates token and returns data
5	End	No further requests	Access complete

💡 Process ends after resource server returns data or token expires

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
authorization_code	None	Received from server	Used and expired	None	None
access_token	None	None	Received from server	Used for resource access	Valid until expiry

Key Moments - 2 Insights

Why does the client not get the access token directly from the user login step?

Because the client first receives an authorization code (Step 2) which it then exchanges for an access token (Step 3). This two-step process improves security by not exposing tokens directly to the user agent.

What happens if the access token is invalid or expired when accessing the resource?

The resource server will reject the request (Step 4), and the client must request a new token, often by repeating the authorization process or using a refresh token if available.

Visual Quiz - 3 Questions

Look at the execution table, at which step does the client receive the access token?

A Step 3

B Step 2

C Step 4

D Step 1

💡 Hint

Check the 'Result' column for Step 3 where the access token is returned.

According to the variable tracker, what happens to the authorization code after Step 3?

A It remains valid

B It is used and expired

C It becomes the access token

D It is sent to the resource server

💡 Hint

Look at the 'authorization_code' row after Step 3 in the variable tracker.

If the user denies permission at Step 2, what would happen in the flow?

A Client receives an access token anyway

B Resource server grants access without token

C Authorization server issues an error instead of a code

D Client skips token exchange

💡 Hint

Consider what happens when user consent is not granted in Step 2 of the execution table.

Concept Snapshot

OAuth 2.0 is a way to let apps access user data securely.
User logs in and grants permission.
Client gets an authorization code.
Client exchanges code for access token.
Token lets client access resources.
Tokens improve security by limiting direct password sharing.

Full Transcript

OAuth 2.0 lets users give apps permission to access their data without sharing passwords. The user logs in at the authorization server and grants permission. The client app gets an authorization code, which it exchanges for an access token. The client then uses this token to access the resource server. The resource server checks the token and returns the requested data. This process keeps user credentials safe and controls access with tokens.