TerminologyIntermediate4-6 min reference
OAuth 2.0 for QA
OAuth 2.0 is an authorization framework — it grants an app limited access to a resource on a user's behalf. It is not authentication (that's OpenID Connect, layered on top). This is a tester-friendly lookup for the vocabulary and the checks you can safely run against an API. For deeper auth-security work, follow the links below.
Vocabulary
| Term | What it is |
|---|---|
| Resource Owner | The user who owns the data |
| Client | The app requesting access |
| Authorization Server | Issues tokens (e.g. login provider) |
| Resource Server | The API holding the protected data |
| Access token | Short-lived credential sent on API calls (Authorization: Bearer …) |
| Refresh token | Long-lived credential used to get a new access token |
| Scope | The specific permissions granted (e.g. read:orders) |
Grant flows (which you'll meet)
| Flow | Used by | Note |
|---|---|---|
| Authorization Code + PKCE | Web & mobile apps | The default today; PKCE is required for public clients |
| Client Credentials | Service-to-service | No user; app authenticates as itself |
| Device Code | TVs, CLIs | User authorizes on a second device |
| Implicit | legacy | Deprecated — flag if you see it |
| Resource Owner Password | legacy | Avoid — app handles the raw password |
What QA can safely verify
- A valid token returns
200; a missing token returns401. - A token with the wrong scope returns
403, not200with empty data. - An expired access token returns
401; the refresh flow then issues a new one. - A token for user A cannot read user B's resources (authorization, not just authentication).
- Tokens are sent over HTTPS and not logged, in URLs, or in analytics.
When to use
Writing API tests around protected endpoints, reviewing an auth story, or sanity-checking scope/expiry behaviour. Keep destructive token-forgery and brute-force work to authorized security testing.
Common mistakes
- Confusing 401 (not authenticated) with 403 (authenticated, not allowed).
- Testing only the happy path — expiry, wrong scope, and cross-user access are where bugs hide.
- Hard-coding a token that expires mid-run instead of refreshing it.
- Assuming OAuth = login; without OIDC there is no verified user identity.
// Related resources