OAuth Interview Questions

OAuth 2.0 shows up constantly in backend, security, and full-stack interviews because it sits at the intersection of protocol design, web security, and practical API integration — interviewers use it to probe whether a candidate actually understands delegated authorization or has just copy-pasted a login button. Strong answers connect the mechanics (redirects, codes, tokens) to the security reasoning behind them (why PKCE exists, why state matters, why access tokens are short-lived), rather than reciting flow diagrams from memory. This topic collects the questions that come up most often, organized from conceptual fundamentals to the security edge cases that separate a junior answer from a senior one.

Almost every OAuth interview opens with 'what problem does OAuth solve and how is it different from authentication,' and a strong candidate immediately distinguishes authorization (what an app is allowed to do) from authentication (who the user is), noting that OAuth 2.0 itself is purely an authorization framework and OpenID Connect is the identity layer built on top of it. Interviewers commonly follow up by asking a candidate to explain the authorization code flow step by step, and the strongest answers narrate it as a sequence of trust boundaries crossed — browser to authorization server, authorization server back to client via redirect, client to token endpoint over a trusted backend channel — rather than just naming the four grant participants (resource owner, client, authorization server, resource server).

Senior-level interviews go beyond the happy path and probe failure modes: 'why does PKCE protect against authorization code interception even for a confidential client,' 'what happens if a redirect_uri validation is done with prefix matching instead of exact matching,' or 'how would you detect a stolen refresh token.' A candidate who can explain that PKCE binds the code exchange to the party that initiated the request (via the verifier/challenge pair), that loose redirect_uri matching enables open-redirect token theft, and that refresh token rotation with reuse detection flags a stolen token the moment both the legitimate client and the attacker try to use it, demonstrates the kind of depth that distinguishes a security-conscious senior engineer from someone who only knows the flow diagram.