What is OAuth 2.0? How Delegated Authorization Works
OAuth 2.0 is the industry-standard protocol for delegated authorization — letting apps access resources on behalf of a user without sharing passwords. Learn how OAuth 2.0 flows work and where it applies in enterprise integrations.
What is OAuth 2.0?
OAuth 2.0 is an open authorization framework that enables an application to obtain limited access to a user's account on another service — without ever seeing the user's credentials. The user grants consent, the authorization server issues an access token, and the client uses that token to call the protected API. OAuth 2.0 is the foundation of most modern 'Sign in with Google/GitHub/Slack' buttons and API authorization systems.
- Enables third-party apps to access resources without sharing passwords
- Issues scoped, time-limited access tokens instead of credentials
- Defines four authorization flows for different client types
- Used by virtually every major API: Google, GitHub, Salesforce, Stripe
- OAuth 2.0 handles authorization; OpenID Connect adds authentication on top
How OAuth 2.0 Works
OAuth 2.0 involves four roles: the Resource Owner (user), the Client (app requesting access), the Authorization Server (issues tokens), and the Resource Server (API). The client redirects the user to the authorization server, the user consents, and the server returns an authorization code. The client exchanges the code for an access token and uses it to call the API.
Authorization request
The client redirects the user to the authorization server with the requested scopes (e.g., read:email, write:calendar) and a redirect URI.
User grants consent
The user logs in (if not already) and approves or denies the requested permissions on the authorization server's consent screen.
Authorization code exchanged
The server redirects back to the client with a short-lived authorization code. The client exchanges it server-side for an access token and optional refresh token.
API access with token
The client includes the access token as a Bearer token in the Authorization header of every API call. The resource server validates the token and responds.
Common OAuth 2.0 Use Cases
SaaS integrations
Connect FlowGenX to a user's Google Workspace, Salesforce, or Slack account without storing their password — access tokens are scoped and revocable.
API-to-API authorization
Backend services authenticate against each other using the OAuth 2.0 Client Credentials flow — no user involved, just a service client ID and secret.
Enterprise SSO federation
Enterprise identity providers (Okta, Azure AD) issue OAuth 2.0 tokens so all internal tools accept a single, centrally managed credential.
OAuth 2.0 in FlowGenX AI
FlowGenX handles OAuth 2.0 flows transparently for all 250+ connectors. When you add a connector like Salesforce or Google Workspace, FlowGenX manages the authorization code flow, securely stores and automatically refreshes access tokens, and scopes each connector to only the permissions it needs. Your AI agents call protected APIs without ever touching credentials.
Frequently Asked Questions
See It In FlowGenX
Related Terms