What Is OAuth2 for External APIs and How Does It Work?

All sorts of different apps can communicate with one another and share data through external APIs; however, providing a third party with access to a user's username and password is no longer seen as a secure method of providing this access. This is where the use of OAuth 2.0 comes into play. OAuth 2.0 is an authorization framework that allows applications to gain access to resources based upon the authorization from a user without exposing their username and password.

Picture this: a business application wants to connect to a third-party application to pull back customer information, sync product information, or automate workflows between the two. Rather than storing or sending a user's password, the business application will receive an access token from the third-party application that provides limited access for a particular duration to perform an action that the user authorized. This process enhances overall security, provides better control over the permissions granted to applications, and has become the de facto method for authenticating requests for external API access in modern applications.

Understanding OAuth 2.0 for External APIs

If the user accesses a website with their Google account, the user does not share their Google password with that website. Rather, Google will authorize the application on the user's behalf and then provide the application with a Token that provides access to specific user information as authorized by the user.

Due to the increased need for businesses to utilize third-party services and integrate with each other's applications through APIs, it is critical that all applications communicate in a secure manner, and OAuth 2.0 provides a means to securely grant access to applications wishing to integrate with one another.

How Does OAuth 2.0 Work?

The workflow of the internals' processes may seem complicated, but in general, the workflow is fairly simple. OAuth 2.0 is a sequence of steps to get the permission of the user to access resources that the user has protected.

The typical flow of OAuth 2.0 will be:

1. The Client Application (the application seeking permission from the user) makes a request for authorization.
2. The user agrees to allow access to the requested resource.
3. The Authorization Server creates an Authorization Code for the Client Application to exchange for an Access Token.
4. The Client Application will use the Authorization Code to request an Access Token from the Authorization Server.
5. The Access Token will be part of the API Requests sent to the Resource Server.
6. The Resource Server validates the Access Token and returns the information that was requested.

This flow of OAuth 2.0 eliminates the need for applications to have direct access to the user's credentials (username and password), which establishes a much more secure authentication model.

Types of Tokens Used in OAuth 2.0

The two primary types of Token in OAuth 2.0 are as follows:

1. An Access Token

When you’re trying to use an API, you will need to send the Access Token along with your request. This type of token is often short-lived, so if someone gets hold of the Access Token, it’ll limit their ability to abuse the token for malicious activity. Some characteristics of Access Tokens include:

• Short-duration/cannot be used as authentication
• Define types of permissions for resource access
• Must be used when making an API request
• Expire after a specific period

2. A Refresh Token

A Refresh Token lets you create a new Access token without having the user go through the sign-in process again.

Some advantages of using Refresh Tokens are:

• Users can have better overall experiences
• Repeat authentication requests are reduced
• Help support long-running integrations

Grant Types of OAuth 2.0

OAuth 2.0 specifies various types of grants and authorization flows which provide different options for application related scenarios. Each grant type has a particular application case and is used depending on the interaction needed with the users.

Here are the types of Grant types used by OAuth 2.0:

1. Authorization code grant: This is the type of grant that is applied by web and mobile applications where users will log in and give their permissions. This is the best method and the most secure OAuth 2.0 type of flow.
2. Client credentials grant: This is the grant type that has been used for server-to-server communication, in which the user does not take part. The application authenticates itself with its own credentials to receive an access token.
3. Device authorization grant: This type of grant has been designed specifically for those devices that carry low-meaning input capability, for instance, smart televisions and gaming consoles. The user program has to provide permission through another device.
4. Refresh token grant: With this grant, the application will receive a new access token as soon as the one employed runs out without requiring the user to enter his/her credentials again.

OAuth 2.0 Scopes

Scopes refer to the amount of access being requested by an application from a user. Rather than giving broad permissions, OAuth 2.0 enables users to give only those permissions needed by the application. The principle of least privilege is applied by the OAuth 2.0 system because this reduces the chances of unauthorized access happening.

During the authorization process, the application determines the scopes to be used. When the authorization service receives the application authorization request, it passes it to the user for acceptance or rejection. If the request is accepted, then the access token will only be valid for the scopes defined in the authorization request.

Some of the popular OAuth scopes include:

• read_profile - This scope allows the application to gain access to the user's profile.
• read_email - This is the scope that is used to gain access to the user's e-mail address.
• read_orders - This gives permission to the application to see the details of the orders placed.
• write_products - This scope allows the application to create or change the information about the products.

Using scopes allows applications to ensure that they obtain only the rights that they need for their work.

OAuth 2.0 Security Best Practices

While OAuth 2.0 offers a secure framework for authorization, it is important to note that the success of its use greatly depends on proper implementation. Compliance with security principles contributes to the protection of users’ data and to blocking unwanted access to the APIs.

Here are some examples of practices that can be used:

1. Always use HTTPS to secure and encrypt communication between clients, authorization, and resource servers.
2. Keep tokens secure and avoid exposing them in public repositories and in client code.
3. Use short-lived Access Tokens in order for their breach not to result in severe consequences.
4. Use Refresh Tokens properly and only if there is actual necessity to get access to new Access Tokens.
5. Stick to the principle of least privilege when requesting scopes and privileges for applications.
6. Validate Access Tokens before granting access to any resources.
7. Secure Client Secrets, keeping them on the server and not exposing them anywhere.

Following the mentioned practices, organizations are able to minimize security threats, thus ensuring consistent and reliable operation of the OAuth 2.0 integration.

OAuth 2.0 has emerged as the industry norm for secure authorization of app access to protected resources without disclosing user credentials. OAuth 2.0 delivers secure application communication through Access Tokens, Refresh Tokens, various grant types, and scopes while allowing users to have better control over information they are allowing to be accessed.

Implementation of OAuth 2.0 is crucial for securing sensitive information as well as maintaining secure API interactions, especially in the context of organizations being more dependent on various third-party integrations and cloud services. Knowing the core information on how OAuth functions, in line with security best practices, will allow developers to create quality and secure apps that live up to modern requirements for authentication and authorization.

To read more about What are the Different Types of APIs & Their Differences, refer to our blog What are the Different Types of APIs & Their Differences.