# Lecture

## OAuth 2.0

You have most likely interacted with OAuth already via "Login with Facebook" or "Login with Google". Either of these options allows you to authenticate yourself without having to use a separate username and password for a particular service, just piggy-back off of another service's authentication. 

| Stakeholder                             | Benefit                                           |
| --------------------------------------- | ------------------------------------------------- |
| Service / application                   | Streamlines user registration / login             |
| Users "resource owners"                 | Minimizes number of accounts                      |
| API "resource server" (Facebook/Google) | Gains valuable data on your use of other services |

### Registration

Our service that intends to use OAuth needs to register itself with the resource server, receiving their own **client ID** and **client secret.**

### Redirect URI

Our service also needs to declare to the resource server a **redirect URI**. This tells the resource server where to bring users back to after logging with their authentication system. 

### Code Generation

1. Service pulls up a custom resource server login page unique to their client ID and redirect URI.
2. Client returned a new code upon successful login
3. Client will use this code to fetch a session token from the resource server

## BELOW IS UNDER DEVELOPMENT

## OAuth 1.0

[creds](https://docs.authlib.org/en/latest/basic/oauth1.html)

### Roles

### Credentials

### Flow

### Signature

## OAuth 2.0

[creds](https://docs.authlib.org/en/latest/basic/oauth2.html)

### Roles

### Flow

### Grant Types

#### Authorization Code

#### Implicit

#### Resource Owner Password

#### Client Credential

### Client Authentication Models

### Scope and Access Control

## OpenID Connect

### Claims


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://backend-course.cornellappdev.com/chapters/oauth/lecture.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.