OAuth 2.0
An authorization protocol formally standardized by the IETF in 2012 via RFC 6749. Its core design principle separates authorization from authentication, splitting the token system into short-lived access tokens and long-lived refresh tokens. It is the prevailing standard for modern web identity authentication.
Core Facts
OAuth 2.0 is defined by the IETF in RFC 6749.
OpenID Connect is an identity layer built on top of OAuth 2.0 that introduces an ID Token, typically in JWT format, for proving user identity to the client.
OAuth 2.0 Token Exchange (RFC 8693) defines a token exchange mechanism that allows a service to exchange a token it already holds for a new token applicable to downstream services.
Timeline (last 90 days)
Identity provider (IdP) registration is usually based on the OAuth 2.0 or OpenID Connect protocol, with AWS as the service provider trusting these identity sources.
OAuth's unit of authorization is the "token" rather than the "message", and validation happens at the credential level rather than the semantic level.
In the OAuth 2.0 authorization code flow, the redirect URI is the address to which the browser is sent back after the user consents to authorization, with the authorization code appended to it and handed to the application.
When configuring Google APIs in n8n, you need to fill the callback URL provided by n8n (usually https://your-n8n-domain/rest/oauth2-credential/callback) into the redirect URI in Google Cloud Console.
Google services such as Gmail issue time-limited access tokens and refresh tokens to third-party apps via OAuth 2.0, and tokens can be silently invalidated due to reasons such as manual revocation by the user, administrator policy changes, or long-term non-use.
The OAuth handshake in the OAuth 2.0 authorization framework typically involves multiple redirects and token exchanges between the client and the authorization server.
The core roles of OAuth 2.0 include the resource owner (user), the client, the authorization server, and the resource server.
Issuing a separate identity for each agent instance and combining it with short-lived tokens (such as OAuth 2.0 client credentials mode or workload identity standards like SPIFFE) aligns credential lifetime with task lifetime.
The Zapier SDK encapsulates OAuth authorization; the SDK holds an authorized connection, and the code side only references the connection identifier, never directly touching tokens.
When a workflow needs to access both Google Calendar and Slack, the developer needs to maintain two independent OAuth authorization chains, two sets of token storage and refresh scheduling logic, and handle anomalies such as users revoking authorization and token leakage.
40 more timeline events
All Facts (20)
OAuth 2.0 is defined by the IETF in RFC 6749.
90%VerifiedOpenID Connect is an identity layer built on top of OAuth 2.0 that introduces an ID Token, typically in JWT format, for proving user identity to the client.
75%VerifiedOAuth 2.0 Token Exchange (RFC 8693) defines a token exchange mechanism that allows a service to exchange a token it already holds for a new token applicable to downstream services.
75%VerifiedMCP's permission model draws on the OAuth 2.0 authorization code flow, requiring explicit user authorization for tool invocation.
75%VerifiedConnecting n8n to Gmail typically relies on Google's OAuth 2.0 authorization mechanism, which allows third-party applications to access Google account resources in a restricted manner after user authorization without obtaining the account password.
65%VerifiedThe OAuth protocol was originally designed to solve the problem of third-party applications accessing resources on behalf of users, with the core mechanism being users authorizing an authorization server in exchange for an access token.
65%VerifiedOAuth is one of the most common authentication mechanisms in the MCP ecosystem; after a user completes identity verification on the authorization server, they receive a time-limited access token and a refreshable refresh token.
65%VerifiedThe OAuth 2.0 protocol is the most widely known implementation of scoped access, with authorization pages explicitly listing the permission scopes requested by an application.
65%VerifiedMicrosoft Graph API is Microsoft's unified RESTful API interface, covering the full suite of Microsoft 365 services including mail, calendar, and files.
65%VerifiedOAuth 2.0专门处理授权委托，OpenID Connect在OAuth 2.0之上叠加身份验证层，SAML多用于企业联邦身份场景
65%VerifiedOAuth 2.0 only addresses authorization, while OIDC adds a standardized identity authentication layer on top of it, introducing an ID Token—typically in JWT format—to carry user identity information.
65%VerifiedThe WeChat Mini Program login process follows a variant of OAuth 2.0's authorization code flow: the front end calls wx.login() to obtain a temporary login credential code, and the server uses the code along with the AppID and AppSecret to exchange for an openid and session_key from WeChat's server.
65%UnverifiedGemini CLI 通过 OAuth 2.0 协议认证，在本地启动临时 HTTP 服务器并打开浏览器完成 Google 账户授权，token 存储在本地配置目录中
90%UnverifiedOAuth 2.0的Access Token通常有效期较短（15分钟到1小时），Refresh Token有效期较长
90%UnverifiedOne API的二次分发Key机制借鉴了OAuth 2.0中的令牌委托模式，原始Key仅存储在服务端
80%UnverifiedGemini CLI的身份认证基于OAuth 2.0协议，如果认证不成功大概率是因为没有开启TUN模式（全局代理模式）
80%UnverifiedWindsurf使用JWT（JSON Web Token）作为用户身份凭证，基于OAuth 2.0认证流程
75%UnverifiedOAuth Token Exchange is defined in RFC 8693 and is being explored by the industry to address the Agent delegation chain problem.
70%UnverifiedThe OAuth pattern authenticates users by introducing an identity provider, and after the tool authenticates, it issues an access token for the agent to use.
60%UnverifiedOAuth 2.0 is an authorization framework that implements identity authentication in conjunction with the OIDC extension.
60%