IT Glossary

OAuth 2.0

OAuth 2.0 is the standard for delegated authorization. Learn how OAuth 2.0 works, how it differs from OIDC and SAML, and why it matters for SaaS access.

June 8, 2026

OAuth 2.0 is an open authorization framework (defined in RFC 6749) that lets an application access resources on behalf of a user without handling that user's password. Instead of sharing credentials, the user grants scoped permission and the application receives a limited-life access token. OAuth 2.0 governs authorization, not authentication, which is the distinction that separates it from SAML and OIDC.

How OAuth 2.0 works

  • A user wants an app (the client) to access data held by another service (the resource server).
  • The client redirects the user to an authorization server to grant consent.
  • The user approves a defined scope of access.
  • The authorization server issues an access token to the client.
  • The client uses that token to call the resource API, within the granted scope and time limit.

OAuth 2.0 vs OIDC vs SAML

OAuth 2.0, OIDC, and SAML: Protocol Comparison

Protocol Primary Purpose Typical Use
OAuth 2.0 Authorization (delegated access) App accessing an API on your behalf
OpenID Connect Authentication, built on OAuth 2.0 Modern login and SSO for web and mobile
SAML Authentication and SSO Enterprise web app SSO

Examples and use cases

A project tool asks to read your Google Calendar. You approve, and it receives a scoped token rather than your Google password. From a governance view, OAuth grants are a blind spot: employees authorize third-party apps to your core systems with a few clicks, which creates shadow connections that IT never reviewed. Visibility over active OAuth grants is now part of serious access governance.

Related concepts

FAQ

Is OAuth 2.0 authentication or authorization?

‍Authorization. It grants scoped access to resources. For authentication, OpenID Connect is layered on top of OAuth 2.0.

What is an OAuth access token?

‍A short-lived credential that represents the permission a user granted. The client app sends it with each API call instead of a password.

Why are OAuth grants a security concern?

‍Because users can authorize third-party apps to reach company data without IT review, which creates unmonitored integrations.

Corma surfaces active OAuth integrations and third-party access across your SaaS stack. See shadow IT visibility or request a demo.