What does OAuth stand for?
OAuth stands for Open Authorization. An authorization framework that lets an app access resources on a user's behalf with a token, without receiving the user's password. On its own it is not an authentication protocol; OpenID Connect adds that.
OAuth lets an application act on a user's behalf at another service without learning the user's password. The user signs in at the service that holds the data and approves a specific request, such as read access to a calendar. The application receives an access token limited to that scope and for a limited time. OAuth is about authorization, what the application may do. Confirming who the user is requires an identity layer on top, OpenID Connect.
OAuth in practice: an example
A scheduling application asks to read a user's work calendar. The user is sent to the company sign-in page, signs in there and sees a consent screen listing calendar read access. After approval the application gets a token that works for the calendar only. It cannot read mail, and the user can revoke it without changing the password.
What OAuth is confused with
OAuth vs OIDC: what is the difference?
OAuth issues access tokens that say what an application may do. OpenID Connect adds an ID token that says who the user is. Sign-in with an external account uses both.
OAuth vs SAML: what is the difference?
SAML passes signed XML assertions about a user's identity for web single sign-on, mostly in enterprises. OAuth passes tokens that grant an application access to an API. What SAML stands for
Which exams cover OAuth?
OAuth is on the official CompTIA acronym list for one of the four exams covered here.
- Security+ SY0-801: 4.5 (Security Operations).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A photo printing site needs to read a user's pictures stored at a cloud provider without receiving the user's password. Which standard is designed for this?
- OAuth
- RADIUS
- Kerberos
- SNMP
Show the answer
A. OAuth. Delegated, limited access to a resource through a token is exactly what OAuth defines. The other protocols authenticate users or manage devices.
2. In OAuth, what limits what an application can do with the access it was given?
- The scopes attached to the token
- The length of the user's password
- The screen resolution
- The DNS record of the application
Show the answer
A. The scopes attached to the token. Scopes name the permissions the user approved. A token for reading a calendar is refused by the mail API.
Sources: RFC 6749: The OAuth 2.0 Authorization Framework; NIST glossary: OAuth; OAuth 2.0 (oauth.net, the OAuth working group community site). The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.