OAuth 2.0

Problem

A photo-printing application needs access to some of your cloud photos. You absolutely don't want to give it your cloud-account password. And you might want it to access photos—but not delete your emails.

Solution — OAuth

You authorize limited access.

You
 ↓ authorize
Photo App
 ↓ receives limited token
Photo Service

You approve access, and the cloud provider's authorization server issues an access token to the photo-printing app. The app uses it to request the permitted photos from the photo API.

Core idea: OAuth lets applications receive limited delegated access without receiving the user's password.