OAuth2 Concepts
Why OAuth2 Exists
Imagine a price-tracker app that wants to read your ShopEase orders. In the old days you would give that app your ShopEase password. That is dangerous: the app can do everything you can, forever, and you cannot take access back without changing your password.
OAuth2 fixes this. Instead of your password, the app gets a limited, short-lived access token that you approved. The token says who may do what (for example "read orders") and for how long. You can revoke it at any time.
Note: OAuth2 is about authorization (delegated access). It does not by itself tell the app who you are. OpenID Connect (OIDC) is a thin layer on top of OAuth2 that adds authentication (identity). "Sign in with Google" is OIDC.
The Four Roles
| Role | Meaning | ShopEase example |
|---|---|---|
| Resource Owner | The user who owns the data | Asha, a ShopEase customer |
| Client | The app that wants access | ShopEase React app, mobile app, a partner app |
| Authorization Server | Logs the user in and issues tokens | Keycloak, Auth0, Google, Spring Authorization Server |
| Resource Server | The API that holds the data and checks tokens | ShopEase order-service, product-service |
Tokens and Scopes
| Token | Who reads it | Typical lifetime | Purpose |
|---|---|---|---|
| Access token | Resource server (API) | 5–15 minutes | Sent as Authorization: Bearer ... to call APIs |
| Refresh token | Authorization server only | hours to days | Gets a new access token without logging in again |
| ID token (OIDC) | Client app | 5–60 minutes | Tells the client who logged in (name, email, subject id) |
A scope is a named permission the client asks for, such as openid, profile, orders.read or orders.write. The user sees the scopes on a consent screen, and the access token carries the scopes that were granted. Spring Security turns each scope into an authority named SCOPE_orders.read.
Tip: Remember the pairing: access token → API, ID token → client. Never send an ID token to your API as a bearer token, and never use an access token to read user identity in the frontend.
Check Yourself
Exercise: A partner app wants to read a customer's orders but must never place orders. Which roles are involved and which scope should the token carry?
Show answer
Resource Owner : the customer
Client : the partner app
Authorization Server: ShopEase's identity provider (e.g. Keycloak)
Resource Server : ShopEase order-service
Scope: orders.read only (not orders.write).
The order-service checks hasAuthority("SCOPE_orders.read") on GET endpoints
and hasAuthority("SCOPE_orders.write") on POST/PUT/DELETE, so the partner
token is rejected with 403 if it tries to place an order.