← All flows
About AuthGod
OAuth 2.0 can be hard to learn. It has several flows, many security details, and a lot of acronyms such as PKCE, CSRF and JWT. AuthGod explains it in plain words, one step at a time.
Each flow has its own page with:
- a short explanation
- a diagram you can step through
- good practices and common mistakes
New terms are explained the first time they appear.
The content follows the official OAuth 2.0 specification (RFC 6749) and related RFCs.
The code examples are meant to teach the idea, so review them before using them in production. If you find a mistake, please tell us so we can fix it.
Official resources
AuthGod is a learning aid. For the authoritative rules, use these:
- OAuth.net — The official OAuth community site
- RFC 6749 — The OAuth 2.0 Authorization Framework
- RFC 7636 — Proof Key for Code Exchange (PKCE)
- OAuth 2.1 — The upcoming consolidated OAuth specification
What is coming next
- Refresh tokens: getting a new access token without asking the user to sign in again
- Scopes: controlling what an app is allowed to do
- Tokens: how bearer tokens and JWTs work
- Redirect URIs: making sure users return to the right place