Explain like I'm five · Security

What is OAuth?

OAuth, told as a story about handing out a ticket instead of your key.

mePhoto CastlePRINTthe print shop?

My photos live in the Photo Castle.The print shop needs to fetch them.

PhotosMailMoneyeverything opens

We used to hand over the whole key.The shop could open not just Photos, but Mail and Money too.

Let this shop into Photos only1I say yesTICKETPhotos · read only30 days2the castle hands the shop a ticketPhotosMailMoneyTICKET3photos only, with the ticket

OAuth hands out a ticket instead of the key.I tell the castle yes, the castle gives the shop a ticket. The key never leaves my pocket.

Mewho owns the photos
The Photo Castlekeeps the photos, prints the tickets
The print shopruns the errand with the ticket
TICKETPhotos · read only30 daysPhotosMailTICKETchange your mind? tear the ticket

The ticket names the room and the time.Photos, read only, 30 days. Change your mind? Tear up the ticket — no need to change the key.

but who are you?TICKETPhotosticket: may enter+NAME TAGme: Jiminname tag: this is me

A ticket doesn't say who you are.A ticket means 'may enter', not 'this is me'. The name tag (OpenID Connect) does that part. Which is also why a lost ticket works for whoever finds it.

In one breath

OAuth = a ticket that lets another shop into one room, for a while — without ever giving it my key.

OAuth 2.0 (2012, RFC 6749). It's what happens behind a 'Continue with Google' button — OAuth does the ticket, OpenID Connect does the name tag.

When grown-ups say it

Resource owner
Me. Owner of the photos. The one who says yes.
Client
The print shop. The app running the errand on my behalf.
Authorization server
The ticket office. Takes my yes and prints the ticket.
Resource server
The photo storeroom. Checks the ticket and hands over photos. Same castle as the ticket office.
Access token
The ticket. What the shop carries. Lost, it works for anyone.
Scope
The room written on the ticket. "Photos · read only." Rooms not listed stay shut.
Refresh token
The reissue coupon. When 30 days pass, this gets a fresh ticket without asking me again.
OpenID Connect
The name tag. Sits on top of OAuth and adds 'this is me'. The real engine behind login buttons.
Next story
The Gatekeeper's Three Questions →
Want another term as a picture book? Request →