Cross Domain · security identity

OAuth 2.0

OAuth 2.0 is an authorization framework that allows third-party applications to securely access a user’s resources (such as accounts or data) on another service without sharing passwords. It is widely used for enabling single sign-on (SSO) and providing secure, delegated access to APIs, with the following benefits.

  • Secure Authorization - OAuth 2.0 allows users to grant limited access to their data without exposing their credentials, reducing the risk of unauthorized access.
  • Granular Permissions - Applications can request specific scopes of access, such as read-only or write permissions, providing fine-grained control over data sharing.
  • Token-Based Authentication - OAuth 2.0 uses access tokens, which are temporary and revocable, reducing security risks associated with long-term credentials.
  • Scalable and Flexible - It supports a variety of client types (e.g., web apps, mobile apps, and IoT devices) and use cases, including single sign-on and third-party integrations.
  • No Password Sharing - Users authenticate with the authorization server, and the application receives a token instead of the user’s password, enhancing security.
  • Industry Standard - OAuth 2.0 is widely adopted and supported by major platforms like Google, Facebook, GitHub, and Microsoft, ensuring compatibility with modern web and mobile applications.
  • Refresh Tokens - Provides a mechanism to renew access tokens without requiring the user to log in again, improving user experience and session management.

OAuth 2.0 has become the industry standard for secure, token-based authorization, enabling applications to access user data without compromising privacy. It is ideal for SSO, API security, and third-party integrations, offering scalability, flexibility, and enhanced security for different types of applications.
There are some complaints that OAuth 2.0 has become very broad and bloated, but it has reached mainstream adoption and will define authentication and authorization across the API landscape for many years to come. When you have wide variety of resources, with many end-users of those resources, applying OAuth 2.0 for API authentication and authorization makes sense.

oauth.net/2/The standard
2019measured implementing it
0tagged with it

Measured implementing OAuth 2.0 2019

These providers were observed, not self-declared: they declare an OAuth 2.0 security scheme in their API contract. Read from the API contracts each provider publishes in the catalog, as of 2026-11-06. The top 300 of 2019 are shown.

declared · 2019

APIs.iodeclaredHubSpotdeclaredSalesforcedeclaredTwiliodeclaredTray.aideclaredHarnessdeclaredMicrosoft Entra ID (formerly Azure AD)declaredConfluentdeclaredAdadeclaredZoomInfodeclaredCustomer.iodeclaredLightspeed CommercedeclaredInfobipdeclaredZoho CRMdeclaredAcronisdeclaredLaunchDarklydeclaredAirwallexdeclaredShopifydeclaredAfterShipdeclaredDynatracedeclaredCDatadeclaredElevenLabsdeclaredWSO2declaredRedoclydeclaredJiradeclaredXerodeclaredBrevodeclaredGainsightdeclaredLeadpingdeclaredConfluent | the Data Streaming PlatformdeclaredDatadog APMdeclaredOracle HospitalitydeclaredUpholddeclaredRelevance AIdeclaredVendastadeclaredSnowflakedeclaredSalesforce Marketing ClouddeclaredSnykdeclaredMicrosoft Azure API ManagementdeclaredThousandEyesdeclaredAtlassiandeclaredCanvadeclaredGreenhousedeclaredGitLabdeclaredKitdeclaredBoom AideclareddrchronodeclaredSMKlogdeclaredFlagsmithdeclaredLuciddeclaredTelnyxdeclaredElation HealthdeclaredDatadogdeclaredOutreachdeclaredAmigodeclaredAzure Data FactorydeclaredRecurlydeclaredBugsnagdeclaredRudderStackdeclaredMicrosoft AzuredeclaredClosedeclaredMailchimpdeclaredPower BIdeclaredProgress SoftwaredeclaredThe Things Network / The Things StackdeclaredConfluencedeclaredOneSignaldeclaredUpstoxdeclaredEsrideclaredMongoDBdeclaredOptimizelydeclaredKlaviyodeclaredAirbytedeclaredMicrosoft Dynamics 365 SalesdeclaredAttentivedeclaredMedplumdeclaredSurfedeclaredChecklydeclaredClickHousedeclaredMicrosoft Azure CdndeclaredDrippaydeclaredOmnisenddeclaredCvent RegistrationdeclaredCventdeclaredGetResponsedeclaredhi.healthdeclaredLoopsdeclaredCanonicaldeclaredLinkedIndeclaredAdobedeclaredLosantdeclaredSquaredeclaredlemlistdeclaredMirakldeclaredAtlassian CompassdeclaredPauboxdeclaredWistiadeclaredZnanyLekarzdeclared0xArchivedeclaredTrellodeclaredAcquiadeclaredBrazedeclaredMicrosoft Azure Health Data ServicesdeclaredMicrosoft Power Platform APIsdeclaredSigma ComputingdeclaredCoda ProjectdeclaredMapp Marketing ClouddeclaredAsanadeclaredDwolladeclaredSlackdeclaredXdeclaredLiveRampdeclaredGoogle VaultdeclaredHealth GorilladeclaredLINEdeclaredThanxdeclaredSeismicdeclaredUnifydeclaredStrivacitydeclaredGoogle Cloud LoggingdeclaredFellowdeclaredGoogle AnalyticsdeclaredMicrosoft Dynamics NAVdeclaredMicrosoft EntradeclaredClickFunnelsdeclaredFlexpadeclaredListrakdeclaredScope3declaredAzure Cost ManagementdeclaredbeehiivdeclaredBitlydeclaredClickupdeclaredDataForSEOdeclaredPrismadeclaredSalesforce Service Cloud APIsdeclaredVeevadeclaredClarivatedeclaredLeadspacedeclaredTextQLdeclaredQontodeclaredCurlecdeclaredGoogle AdsdeclaredGoogle DialogflowdeclaredCognydeclaredBlueshiftdeclaredContext.devdeclaredDash0declaredLaraveldeclaredMicrosoft Azure Cache For RedisdeclaredNetlifydeclaredPrismicdeclaredZendeskdeclaredFireflies.aideclaredHootsuitedeclaredLightfielddeclaredAzure Kubernetes ServicedeclaredRemotedeclaredBrowser UsedeclaredGitHub CopilotdeclaredMicrosoft PurviewdeclaredSendPulsedeclaredDoiTdeclaredG2declaredImprovadodeclaredUserGemsdeclaredAWeberdeclaredBenchlingdeclaredEclipse FoundationdeclaredMatomodeclaredAuth0declaredAdobe WorkfrontdeclaredBitbucketdeclaredZapierdeclared360LearningdeclaredFacebook Business ManagerdeclaredUnbouncedeclaredBlnk FinancedeclaredEnchargedeclaredGoogle Cloud StoragedeclaredHunterdeclaredDocusigndeclaredGoogle Maps PlatformdeclaredMemo BankdeclaredMonte Carlodeclared8x8declaredCompanyCamdeclaredProfounddeclaredTabooladeclaredTapfiliatedeclaredCloudBeesdeclaredDensifydeclaredMailerLitedeclaredMicrosoft Azure Communication ServicesdeclaredAntavodeclaredCongadeclaredAzure Stream AnalyticsdeclaredDemandbasedeclaredDevCycledeclaredFrontAppdeclaredVirto CommercedeclaredAlphaAIdeclaredConstant ContactdeclaredTranscriptFetchdeclaredMicrosoft Azure QuantumdeclaredAdobe CampaigndeclaredDratadeclaredThriveCartdeclaredBuildkitedeclaredJotformdeclaredMicrosoft OutlookdeclaredAvalaradeclaredBirdeyedeclaredCvent Event ClouddeclaredFLORAdeclaredGoogle Search ConsoledeclaredCanvasdeclaredHabudeclaredLilideclared6sensedeclaredBetter StackdeclaredCoresignaldeclaredForagedeclaredGoogle Campaign ManagerdeclaredMicrosoft Dynamics 365 Business CentraldeclaredSnov.iodeclaredCohesitydeclaredSegminddeclaredSimon DatadeclaredZendesk SelldeclaredLacunadeclaredAlpacadeclaredCisco XDRdeclaredConnecteamdeclaredRybbitdeclaredSquarespacedeclaredVirix LabsdeclaredMoneyhubdeclaredThe ColonydeclaredAgorapulsedeclaredCanvas MedicaldeclaredApigeedeclaredBrand API (Brandfetch)declaredTriple WhaledeclaredBrowserStackdeclaredMicrosoft Office 365declaredParalleldeclaredStayingAPIdeclaredZoom PhonedeclaredGivebutterdeclaredHightouchdeclaredIntegrationOSdeclaredKnakdeclaredMicrosoft IntunedeclaredSemrushdeclaredAtlardeclaredInfordeclaredMicrosoft OfficedeclaredRocketReachdeclaredTaskfolkdeclaredGemini Trust CompanydeclaredNutshelldeclaredDremio | Intelligent Lakehouse PlatformdeclaredExtoledeclaredInstagramdeclaredCanopy ConnectdeclaredSendclouddeclaredShowpaddeclaredEnphase EnergydeclaredFlowAccountdeclaredGoogledeclaredMicrosoft Azure Private LinkdeclaredInstantlydeclaredBlueConicdeclaredComplyAdvantagedeclaredGoogle WorkspacedeclaredFrame.iodeclaredGetAcceptdeclaredIronfangdeclaredMicrosoft Azure FunctionsdeclaredRhombus SystemsdeclaredToastdeclaredZillapideclaredLawVudeclaredNatural AIdeclaredSAP EmarsysdeclaredBriadeclaredMicrosoft Active DirectorydeclaredMolliedeclaredAzure AutomationdeclaredPalo Alto NetworksdeclaredPostizdeclaredAcousticdeclaredAzure Service BusdeclaredTradeshiftdeclaredAhrefsdeclaredKhorosdeclaredMicrosoft Azure BatchdeclaredFamadeclaredGoToWebinardeclaredInflection.iodeclared

Providers that carry OAuth 2.0 0

No provider in the catalog carries this standard as a tag yet. That is a statement about the catalog's tagging, not about adoption: a provider that implements OAuth 2.0 and says so in its APIs.json profile appears here on the next build. Add or correct a listing.

Reading

Read from the API Evangelist standards directory. Provider links come from the catalog's own identity tags and are rebuilt nightly. If this page is wrong about a standard or a provider, say so.