Mastering OAuth 2.0

Authorization via application instead of user-agent

With the typical OAuth 2.0 authorization flow, your application will direct your user's user-agent to the service provider's authorization endpoint where they can log in and authorize your application. However, in the world of mobile applications, certain platforms and service providers support the ability to perform this authorization flow within the service provider's mobile application and not with a user-agent.

For example, if you were to write a mobile application that integrates with Facebook, typically, when your user goes to authenticate, your application will send their user-agent to Facebook's authorization endpoint. However, Facebook on iOS allows this operation to happen via the Facebook ...