Test your OAuth knowledge with a free interactive quiz — 20 questions with answers and explanations. No signup needed to play.
Question 1/12Score 0
What is an "access token" in OAuth 2.0, and what is it used for?
In this round
What is an "access token" in OAuth 2.0, and what is it used for?
What is OAuth (2.0), at its core purpose?
What is "PKCE" (Proof Key for Code Exchange), and why is it particularly important for OAuth flows involving mobile apps or single-page applications (SPAs) that can't securely store a client secret?
What is a general reason a developer building a new application might choose to integrate "Sign in with [Provider]" (using OAuth/OIDC via an established provider like Google or GitHub) rather than building and maintaining their own custom username/password authentication system from scratch?
What is a "userinfo endpoint" in OpenID Connect, and how does it relate to (and differ from) the information already available directly within an ID token?
What is a "state" parameter commonly used for in an OAuth 2.0 authorization request, and what security risk does it help mitigate?
What is the key difference between "authentication" and "authorization," and how does this distinction relate to what OAuth was originally designed to solve?
What is a reasonable general summary of why OAuth 2.0's design (delegated, scoped, token-based access rather than password-sharing) represented a meaningful security improvement over an older, now-discouraged pattern where a third-party app would directly ask a user for their actual username/password to a different service (sometimes called the "password anti-pattern")?
What is "token revocation" in OAuth 2.0, and why might a service need this capability beyond simply letting tokens expire naturally?
What are the key "roles" defined in the OAuth 2.0 framework — the Resource Owner, Client, Authorization Server, and Resource Server?
What is a "scope" in an OAuth 2.0 authorization request, and what does it let a user control?
What is the general risk of a client application requesting overly broad OAuth scopes (asking for more access/permissions than it actually needs to function)?