OAuth 2.0 overview in Rest API - Step-by-Step Execution

Concept Flow - OAuth 2.0 overview

User wants to access resource

↓

Client requests authorization

↓

Authorization Server authenticates user

↓

User grants permission

↓

Authorization Server issues access token

↓

Client uses token to access resource

↓

Resource Server validates token and serves data

↓

End

This flow shows how a user authorizes a client app to access resources securely using tokens.

Execution Sample

Rest API

GET /authorize?client_id=abc&response_type=code HTTP/1.1
Host: auth.example.com

User logs in and grants access

Response: Authorization code

POST /token HTTP/1.1
Host: auth.example.com
Content-Type: application/x-www-form-urlencoded

code=authorization_code&grant_type=authorization_code&client_id=abc&client_secret=secret

GET /resource HTTP/1.1
Authorization: Bearer access_token

This example shows the main HTTP steps in OAuth 2.0: authorization request, token exchange, and resource access.

Execution Table

Step	Action	Request/Response	Result
1	Client requests authorization	GET /authorize?client_id=abc&response_type=code	Authorization server shows login and consent
2	User authenticates and grants permission	User submits login and consent form	Authorization server issues authorization code
3	Client exchanges code for token	POST /token with code	Authorization server returns access token
4	Client accesses resource	GET /resource with Authorization: Bearer token	Resource server validates token and returns data
5	End	No further requests	Access complete

💡 Process ends after resource server returns data or token expires

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
authorization_code	None	Received from server	Used and expired	None	None
access_token	None	None	Received from server	Used for resource access	Valid until expiry

Key Moments - 2 Insights

Why does the client not get the access token directly from the user login step?

Because the client first receives an authorization code (Step 2) which it then exchanges for an access token (Step 3). This two-step process improves security by not exposing tokens directly to the user agent.

What happens if the access token is invalid or expired when accessing the resource?

The resource server will reject the request (Step 4), and the client must request a new token, often by repeating the authorization process or using a refresh token if available.

Visual Quiz - 3 Questions

Look at the execution table, at which step does the client receive the access token?

A Step 3

B Step 2

C Step 4

D Step 1

💡 Hint

Check the 'Result' column for Step 3 where the access token is returned.

According to the variable tracker, what happens to the authorization code after Step 3?

A It remains valid

B It is used and expired

C It becomes the access token

D It is sent to the resource server

💡 Hint

Look at the 'authorization_code' row after Step 3 in the variable tracker.

If the user denies permission at Step 2, what would happen in the flow?

A Client receives an access token anyway

B Resource server grants access without token

C Authorization server issues an error instead of a code

D Client skips token exchange

💡 Hint

Consider what happens when user consent is not granted in Step 2 of the execution table.

Concept Snapshot

OAuth 2.0 is a way to let apps access user data securely.
User logs in and grants permission.
Client gets an authorization code.
Client exchanges code for access token.
Token lets client access resources.
Tokens improve security by limiting direct password sharing.

Full Transcript

OAuth 2.0 lets users give apps permission to access their data without sharing passwords. The user logs in at the authorization server and grants permission. The client app gets an authorization code, which it exchanges for an access token. The client then uses this token to access the resource server. The resource server checks the token and returns the requested data. This process keeps user credentials safe and controls access with tokens.

Practice

1. What is the main purpose of OAuth 2.0 in REST APIs?

easy

A. To replace usernames with email addresses

B. To encrypt all data sent between client and server

C. To allow apps to access user data securely without sharing passwords

D. To speed up API response times

Solution

1. Step 1: Understand OAuth 2.0's role

   OAuth 2.0 is designed to let apps access user data safely without needing the user's password.

2. Step 2: Compare options to OAuth 2.0 purpose

   Only To allow apps to access user data securely without sharing passwords correctly describes this purpose. Options A, B, and D describe unrelated functions.

3. Final Answer:

   To allow apps to access user data securely without sharing passwords -> Option C

4. Quick Check:

   OAuth 2.0 = Secure data access without password sharing [OK]

Hint: OAuth 2.0 = safe access without password sharing [OK]

Common Mistakes:

• Confusing OAuth with encryption protocols
• Thinking OAuth replaces usernames
• Assuming OAuth speeds up APIs

2. Which of the following is the correct OAuth 2.0 flow step to get an access token?

easy

A. Client sends password directly to resource server

B. Client sends authorization code to the authorization server

C. Resource server sends access token to client without request

D. Client sends refresh token to user

Solution

1. Step 1: Identify OAuth 2.0 token exchange step

   The client sends the authorization code to the authorization server to exchange it for an access token.

2. Step 2: Eliminate incorrect options

   Client sends password directly to resource server is wrong because passwords are not sent directly. Resource server sends access token to client without request is wrong because tokens are sent after request. Client sends refresh token to user is wrong because refresh tokens are sent to the authorization server, not the user.

3. Final Answer:

   Client sends authorization code to the authorization server -> Option B

4. Quick Check:

   Authorization code sent to server = Step to get access token [OK]

Hint: Authorization code sent to server to get token [OK]

Common Mistakes:

• Sending password instead of authorization code
• Expecting tokens without request
• Confusing refresh token recipient

3. Given this OAuth 2.0 flow snippet:

1. Client requests authorization code
2. User grants permission
3. Client receives authorization code
4. Client sends authorization code to token endpoint
5. Token endpoint returns access token

What is the output after step 5?

medium

A. Client has an access token to access protected resources

B. Client has the user's password

C. Client can directly access user data without token

D. Client must request authorization code again

Solution

1. Step 1: Follow OAuth 2.0 flow steps

   After step 5, the client receives an access token from the token endpoint.

2. Step 2: Understand access token purpose

   The access token lets the client access protected user data securely without needing the password.

3. Final Answer:

   Client has an access token to access protected resources -> Option A

4. Quick Check:

   Access token received = Access to resources [OK]

Hint: Access token means access granted to resources [OK]

Common Mistakes:

• Thinking client gets user password
• Assuming token is not needed for access
• Believing authorization code must be requested again

4. Identify the error in this OAuth 2.0 flow:

Client sends access token directly to user
User sends authorization code to resource server

medium

A. Access token should be sent to resource server, not user

B. Authorization code should be sent to client, not user

C. Client should never send tokens at all

D. User should send access token to authorization server

Solution

1. Step 1: Analyze token flow roles

   Access tokens are meant for the resource server to verify access, not for the user.

2. Step 2: Check authorization code flow

   The authorization code is sent from user to client, not to the resource server.

3. Final Answer:

   Access token should be sent to resource server, not user -> Option A

4. Quick Check:

   Access token destination = Resource server [OK]

Hint: Access token goes to resource server, not user [OK]

Common Mistakes:

• Sending access token to user instead of server
• Confusing authorization code recipient
• Thinking client never sends tokens

5. You want to build an app that accesses user data from a REST API using OAuth 2.0. Which combination correctly describes the roles and tokens involved?

hard

A. Client app sends refresh token to user to renew access token

B. User sends access token to client app, which then sends password to resource server

C. Resource server issues authorization code directly to client app without user consent

D. Client app uses authorization code to get access token from authorization server, then uses access token to access resource server

Solution

1. Step 1: Understand OAuth 2.0 roles

   The client app requests an authorization code from the authorization server after user consent.

2. Step 2: Token exchange and usage

   The client exchanges the authorization code for an access token, then uses it to access the resource server.

3. Final Answer:

   Client app uses authorization code to get access token from authorization server, then uses access token to access resource server -> Option D

4. Quick Check:

   Authorization code -> access token -> resource access [OK]

Hint: Authorization code to token, then token to resource [OK]

Common Mistakes:

• Thinking user sends tokens to client
• Assuming resource server issues codes without user
• Confusing refresh token flow