OAuth 2.0 Explained Simply: Authorization for Developers
OAuth 2.0 made simple: authorization code flow, PKCE, access tokens, refresh tokens, scopes, and when to use which flow.
OAuth 2.0 in 30 Seconds
OAuth lets users grant limited access to their resources without sharing passwords. Example: "Sign in with Google" — Google gives the app a token to read your profile, but the app never sees your Google password.
Authorization Code Flow (Recommended)
- App redirects user to authorization server
- User logs in and approves permissions
- Server redirects back with an authorization code
- App exchanges code for access token (server-to-server)
- App uses access token to call APIs
Inspect access tokens (usually JWTs) with our JWT Decoder.
Try It Free
Use our free online tool — 100% client-side, no data leaves your browser.
Open JWT Decoder