OAuth2 is an authorization protocol that lets a user grant a third-party application limited access to their data on another service, without ever sharing their password with that application.
Key Points: • The user is redirected to the resource owner's authorization server to log in and approve the requested scopes. • On approval, the authorization server issues an authorization code (or token, depending on grant type) back to the client application. • The client exchanges that code for an access token, typically via a secure back-channel server-to-server call. • The access token is then presented on subsequent API calls to prove the client is authorized to act on the user's behalf. • Tokens are scoped and time-limited, so access can be constrained and revoked without changing the user's password.
Example: Clicking "Sign in with Google" on a third-party site sends you to Google's login page; after you approve, Google gives the site a token that lets it read your profile but never exposes your Google password to that site.
Interview Tip: A concise interview answer is:
"OAuth2 lets a user authorize an application to access their data without sharing credentials. The flow redirects the user to the provider's login, the provider issues an authorization code after consent, and the app exchanges that code for an access token it uses on future API calls."