OAuth 2.0 and OpenID Connect Explained

Authentication vs. Authorization

Before diving into OAuth, you must understand the difference. Authentication is proving who you are (checking your passport). Authorization is proving what you are allowed to do (giving you a VIP backstage pass). OpenID Connect handles Authentication. OAuth 2.0 handles Authorization.

The OAuth 2.0 Authorization Code Flow

When a user clicks "Log in with Google," your app redirects them to Google's server. They log in and Google redirects them back to your site with a temporary "Authorization Code" in the URL. Your backend server then secretly contacts Google, trades that temporary code for an "Access Token," and uses that token to fetch the user's email address.

Why Not Just Send the Token Immediately?

If Google sent the Access Token directly in the URL redirect (known as the Implicit Flow), any malicious browser extension or middleman could intercept it. By using the Authorization Code Flow, the actual Access Token is only ever exchanged server-to-server, making it infinitely more secure.