What best describes OAuth?

What best describes OAuth?

• A. A programming language.
• B. An authentication mechanism that allows a person to use one username/password combination to access multiple sites.
• C. A database join type.
• D. A type of API.

Answer: (B)

OAuth is a framework for authorization that lets a user give a third‑party application access to their resources on another service without sharing their password. It works by the user authorizing a token-based grant, so the third party receives an access token (and possibly a refresh token) that represents permission to act on the user’s behalf within defined scopes. This enables a single identity to be used across multiple sites without exposing the actual credentials, a user experience often described as single sign-on in practice. That described idea—using one set of credentials to access multiple services—captures the practical effect OAuth aims for: centralized trust with limited, revocable access granted via tokens instead of passwords. However, it’s worth noting that OAuth is fundamentally about authorization, not authentication itself, even though many workflows enable login-like experiences through the identity provider. The other options aren’t a fit: OAuth isn’t a programming language, isn’t a database join type, and isn’t a type of API, though it does define a protocol used over HTTP to authorize access.

OAuth is a framework for authorization that lets a user give a third‑party application access to their resources on another service without sharing their password. It works by the user authorizing a token-based grant, so the third party receives an access token (and possibly a refresh token) that represents permission to act on the user’s behalf within defined scopes. This enables a single identity to be used across multiple sites without exposing the actual credentials, a user experience often described as single sign-on in practice.

That described idea—using one set of credentials to access multiple services—captures the practical effect OAuth aims for: centralized trust with limited, revocable access granted via tokens instead of passwords. However, it’s worth noting that OAuth is fundamentally about authorization, not authentication itself, even though many workflows enable login-like experiences through the identity provider.

The other options aren’t a fit: OAuth isn’t a programming language, isn’t a database join type, and isn’t a type of API, though it does define a protocol used over HTTP to authorize access.