OAuth 2.0 Authorization
OAuth 2.0 is an authorization framework that lets an application obtain limited access to a user account on another service without handling the user password. The user approves requested scopes, and the application receives an access token it uses to call the service API.
Technical Architecture & Deep-Dive
OAuth powers sign in with Google, Salesforce integrations, and GitHub app access. It defines roles, including the resource owner, client, authorization server, and resource server, and flows such as authorization code, client credentials, and device code.
Access tokens are short-lived, while refresh tokens obtain new access tokens. Refresh tokens and client secrets are highly sensitive and should be stored server-side or in an edge vault, never in browser storage.
Key Architectural Benefits
Implement OAuth 2.0 Authorization at the Edge
Deploy lightweight API aggregation, edge caching, and secret injection in minutes without Docker containers or complex servers.
Frequently Asked Questions
Q:Is OAuth 2.0 an authentication protocol?
No. OAuth handles authorization, meaning access to resources. OpenID Connect adds an identity layer on top of OAuth for authentication.
Related Architecture Concepts
PKCE, short for Proof Key for Code Exchange, is an OAuth 2.0 extension that protects the authorization code flow for public clients like mobile apps and single-page applications. The client sends a hashed code challenge, then proves possession of the original verifier when exchanging the code for tokens.
OpenID Connect (OIDC) is an identity layer built on OAuth 2.0 that lets applications verify who a user is. Alongside an access token, the identity provider issues a signed ID token, a JWT containing claims such as the user ID, email, and authentication time.
A bearer token is an access credential sent in the HTTP Authorization header as Bearer followed by the token. Whoever bears, or holds, the token is granted access, without additional proof of identity, so bearer tokens must be transmitted only over HTTPS and kept confidential.
A JSON Web Token (JWT) is a compact, URL-safe token containing a JSON payload of claims, such as user ID and expiration, signed by the issuer. Servers verify the signature to trust the claims without a database lookup, enabling stateless authentication.
Ready-to-Use Edge Recipes
You should not store Salesforce credentials in React client code. Vault-inject OAuth or integration tokens at the edge; React calls one public client token URL. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
You should not store Salesforce credentials in JavaScript / HTML client code. Edge pipeline attaches Bearer tokens so static sites never embed secrets. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.