OAuth2 Interview Questions and Answers (15 Must-Know Questions)

Learn OAuth2 through 15 interview questions and answers. Understand OAuth2 architecture, grant types, PKCE, access tokens, refresh tokens, scopes, Spring Boot implementation, production use cases, common mistakes, and best practices.

Introduction

OAuth2 (Open Authorization 2.0) is the industry-standard authorization framework that enables applications to securely access protected resources on behalf of users without sharing their passwords. It is widely used by Google, Microsoft, GitHub, Facebook, Salesforce, banking platforms, and enterprise microservices.

What You'll Learn

OAuth2 fundamentals
OAuth2 roles
Grant types
Authorization Code Flow
PKCE
Access & Refresh Tokens
Scopes
OAuth2 vs OIDC
Spring Boot integration
Enterprise best practices

OAuth2 Architecture

flowchart LR
    CL["Client"] -->|Authorization Request| AS["Authorization Server"]
    AS -->|Access Token| CL
    CL -->|Access Token| RS["Resource Server\n(Protected APIs)"]

OAuth2 Authorization Code Flow

sequenceDiagram
    participant U as User
    participant CA as Client Application
    participant AS as Authorization Server
    participant GW as API Gateway
    participant API as Protected API
    U->>CA: Login / Action
    CA->>AS: Authorization Request
    AS->>CA: Authorization Code
    CA->>AS: Exchange Code for Token
    AS->>CA: Access Token
    CA->>GW: Request + Access Token
    GW->>API: Forward Request
    API->>CA: Response

1. What is OAuth2?

Answer

OAuth2 is an authorization framework that allows applications to obtain limited access to protected resources without exposing user credentials.

Key Benefits

Secure delegated access
Password never shared
Industry standard
Supports web, mobile, and APIs

2. Why was OAuth2 introduced?

Answer

OAuth2 was introduced to solve the problem of applications requesting user passwords directly.

Instead of sharing credentials:

flowchart TD
    U["User"] --> AS["Authorization Server"]
    AS --> AT["Access Token"]
    AT --> APP["Application"]

Benefits:

Better security
Token-based access
Centralized authentication
Easy revocation

3. What are the OAuth2 Roles?

Answer

OAuth2 defines four roles:

Role	Responsibility
Resource Owner	User
Client	Application requesting access
Authorization Server	Issues tokens
Resource Server	Hosts protected APIs

4. What are OAuth2 Grant Types?

Answer

Common grant types:

Grant Type	Use Case
Authorization Code	Web applications
Authorization Code + PKCE	Mobile & SPA
Client Credentials	Service-to-service
Refresh Token	Renew expired tokens

Legacy grants:

Password Grant (Deprecated)
Implicit Grant (Deprecated)

5. What is Authorization Code Flow?

Answer

Most secure OAuth2 flow for web applications.

User
 ↓
Login
 ↓
Authorization Server
 ↓
Authorization Code
 ↓
Client
 ↓
Access Token

Advantages:

Secure
Refresh token support
No token exposed in browser URL

6. What is PKCE?

Answer

PKCE (Proof Key for Code Exchange) protects Authorization Code Flow for public clients like mobile apps and SPAs.

Flow:

Code Verifier

↓

Code Challenge

↓

Authorization Code

↓

Token Exchange

↓

Verifier Validation

Benefits:

Prevents authorization code interception
Recommended for mobile and SPA applications

7. What is an Access Token?

Answer

Access Token authorizes API requests.

Example:

Authorization:
Bearer eyJhbGciOi...

Characteristics:

Short-lived
Contains scopes
Passed with every API request

8. What is a Refresh Token?

Answer

Refresh Token is used to obtain a new access token without requiring the user to log in again.

Flow:

Expired Access Token

↓

Refresh Token

↓

Authorization Server

↓

New Access Token

Best Practices:

Store securely
Rotate refresh tokens
Long-lived but revocable

9. What are OAuth2 Scopes?

Answer

Scopes define what a client is allowed to access.

Examples:

read

write

profile

email

admin

Example Token:

{
  "scope": "read write profile"
}

10. OAuth2 vs OpenID Connect?

Answer

OAuth2	OpenID Connect
Authorization	Authentication + Authorization
Access Token	Access Token + ID Token
API access	User identity
Resource protection	Single Sign-On

11. How is OAuth2 implemented in Spring Boot?

Answer

Dependency

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>

Configuration

@Bean
SecurityFilterChain security(HttpSecurity http) throws Exception {

    http
      .authorizeHttpRequests(auth ->
          auth.anyRequest().authenticated())
      .oauth2ResourceServer(
          oauth -> oauth.jwt());

    return http.build();
}

12. What are Enterprise OAuth2 Use Cases?

Answer

Examples:

Google Login
Microsoft Entra ID
GitHub Login
Banking APIs
Healthcare APIs
Microservices
B2B Partner APIs
API Gateway authentication

Architecture

Client

↓

Identity Provider

↓

JWT Token

↓

API Gateway

↓

Microservices

13. What are Common OAuth2 Mistakes?

Answer

Common mistakes include:

Using Password Grant
Using Implicit Flow
Long-lived access tokens
Missing scope validation
Storing tokens insecurely
No HTTPS
Missing PKCE
Hardcoded client secrets
Logging tokens
No token revocation

14. What are OAuth2 Best Practices?

Answer

Recommended practices:

Always use HTTPS
Prefer Authorization Code + PKCE
Keep access tokens short-lived
Use refresh token rotation
Validate issuer
Validate audience
Validate expiration
Use least privilege scopes
Protect client secrets
Monitor authentication failures

15. How Does OAuth2 Work in Production?

Answer

Production flow:

User

↓

Login

↓

Authorization Server

↓

Access Token

↓

API Gateway

↓

JWT Validation

↓

Microservices

↓

Database

Production Components:

Identity Provider
Authorization Server
API Gateway
Resource Server
Monitoring
Logging
Rate Limiting
Secret Management

OAuth2 Summary

Concept	Description
OAuth2	Authorization framework
Access Token	API authorization
Refresh Token	Token renewal
PKCE	Secure public clients
Authorization Code	Most secure user flow
Client Credentials	Service-to-service
Scope	Permission
Resource Server	Protected APIs
Authorization Server	Issues tokens
HTTPS	Secure transport

Interview Tips

Explain OAuth2 as an authorization framework, not an authentication protocol.
Clearly differentiate Access Token and Refresh Token.
Recommend Authorization Code Flow with PKCE for modern applications.
Explain OAuth2 roles before discussing grant types.
Mention scopes, token validation, and HTTPS.
Compare OAuth2 with OpenID Connect.
Discuss service-to-service authentication using Client Credentials.
Highlight token expiration and refresh mechanisms.
Mention Spring Security Resource Server support.
Use enterprise examples like Google Login, Microsoft Entra ID, and banking APIs.

Key Takeaways

OAuth2 is the industry standard for delegated authorization.
It allows secure access to protected resources without sharing user passwords.
The four core roles are Resource Owner, Client, Authorization Server, and Resource Server.
Authorization Code with PKCE is the recommended flow for web, mobile, and SPA applications.
Access Tokens authorize API requests, while Refresh Tokens obtain new Access Tokens.
Scopes implement least-privilege access control.
OAuth2 does not authenticate users; OpenID Connect extends OAuth2 to provide authentication.
Spring Security makes OAuth2 Resource Server integration straightforward.
Always use HTTPS, short-lived tokens, PKCE, secure token storage, and token validation in production.
OAuth2 is a foundational topic for Java, Spring Boot, Microservices, Cloud, and Solution Architect interviews.