What is the difference between OAuth 2.0 and OpenID Connect in one sentence?

OAuth 2.0 issues access tokens that prove what the holder may do with an API, and OpenID Connect adds a verifiable ID token on the same flow that proves who just logged in. If you're building Login with Google, you want OIDC; if you're accessing a user's calendar on their behalf, that's OAuth.

Why is the implicit flow deprecated?

It returned the access token directly in the redirect URL fragment, exposing it to browser history, logs, referrer leakage, and injected scripts, with no client authentication step at all. The authorization code flow with PKCE gives browser and mobile apps the same one-redirect experience while keeping tokens out of URLs, so OAuth 2.1 removes implicit entirely.

Do I need OAuth for my own first-party app talking to my own API?

No. OAuth solves delegation across trust boundaries, and a first-party app, API, and user database all owned by you has no such boundary; plain sessions or your own token issuance are fine. OAuth starts paying for itself when third-party clients appear, or when many of your own apps need single sign-on against one identity service.

Securitychapter 3 of 4 · 4 lessons

OAuth 2.0 & OpenID Connect

OAuth delegates authorization (can App X access resource Y); OIDC adds authentication on top.

← All chapters View in cheatsheet

In 2008, an app that wanted to import your contacts asked you for your email password. The big social networks did exactly this, and millions of people typed it in.

Think about what that handed over. Not the contacts. The account that can reset every other password you own, with no way to grant less, no way to see which apps held it, and no way to revoke one without changing the password and breaking all of them.

OAuth exists so that never has to happen again. Your credentials go to one place, and the app gets a narrow, revocable token instead.

It is also routinely misused as a login system, which it is not, and that particular confusion has shipped real account-takeover bugs at companies you have heard of.

Lessons

4 in this chapter

The Delegation ProblemBefore OAuth, apps asked for your email password. Four roles replaced that with scoped, revocable grants.2 min
The Authorization Code FlowRedirect out, code back, exchange server-to-server: the one OAuth sequence to know cold.2 min
The Tokens InvolvedAccess, refresh, and ID tokens each have exactly one job, and mixing them up is the classic trap.2 min
OIDC: Authentication on TopOAuth says what the holder may do; the OIDC ID token says who logged in, verifiably.3 min