The encyclopedia · Software & IT · Technical decision · 2007–2012
OAuth 2.0 ended password sharing and became the web's authorization layer
RFC 6749 gave every app a token with scope and lifetime, so users stopped handing passwords to strangers
IETF · Google · Twitter
the move
Before OAuth 2.0, a third-party app that wanted to read your photos or contacts often asked you to hand over your password — storing it in the clear, gaining full access, and leaving you unable to revoke one app without changing the password everywhere.
RFC 6749, published in October 2012, formalized the token-based model: the resource owner authenticates to an authorization server, which issues the client an access token with a specific scope and lifetime. The client uses that token against the resource server and never sees the password.
Because the protocol is built on HTTP and defines a small set of grant types, every major platform — Google, Facebook, GitHub, Microsoft, and thousands more — could implement it. It became the universal vocabulary of web authorization, from 'Sign in with Google' to API delegation.
why it works
- Passwords stopped leaving the user's control, eliminating the cleartext-credential store
- Scopes and expiry let users grant limited, temporary access instead of full account keys
- Revocation became per-app: killing one token never touched the other integrations
- A small HTTP-based spec was implementable by any service, not just the giants
what transfers
Shrink the credential to fix trust: scoped, expiring, revocable tokens turn delegation into an ordinary API call and become every platform's default.
what came after
OAuth 2.0 became the industry's default authorization framework, with bearer tokens powering most public APIs and federated sign-in; extensions like OpenID Connect layered identity on top. Its flaws — notably bearer-token theft — later drove the push toward proof-of-possession tokens and WebAuthn, but the delegation model itself never went away.
references
spotted an error? The archive wants to know.