OAuth: Your valet key for the Web

Just published at http://oauth.net/documentation/spec:  Draft 1 of the OAuth specification.  As my day job allows, I've been contributing to the OAuth working group.  We'd love feedback.

What is it?

OAuth is like a valet key for all your web services.  A valet key lets you give a valet the ability to park your car, but not the ability to get into the trunk or drive more than 2 miles or redline the RPMs on your high end German automobile.  In the same way, an OAuth key lets you give a web agent the ability to check your web mail but NOT the ability to pretend to be you and send mail to everybody in your address book.

Today, basically there are two ways to let a web agent check your mail.  You give it your username and password, or it uses a variety of special-purpose proprietary APIs like AuthSub, BBAuth, OpenAuth, Flickr Auth, etc. to send you over to the web mail site and get your permission, then come back.  Except that since mostly they don't implement the proprietary APIs, and just demand your username and password.  So you sigh and give it to them, and hope they don't rev the engine too hard or spam all your friends.  We hope OAuth will change that.

OAuth consolidates all of those existing APIs into a single common standard that everybody can write code to.  It explicitly does not standardize the authentication step, meaning that it will work fine with current authentication schemes, Infocard, OpenID, retinal scans, or anything else.

And yes, it will work for AtomPub and other REST services, and I hope it will be the very last authorization protocol your client ever needs to add for those things.

For more information and ongoing updates, go to http://oauth.net/.

Note: I picked up the "valet key" metaphor from Eran's postings. Thanks Eran!


"We have lost control of the apparatus" -- Raganwald

Yet another great post from Raganwald: Wehave lost control of the apparatus.
Our users are being exposed to applications we don’tcontrol. And it messes things up. You see, the users get exposed toother ways of doing things, ways that are more convenient for users,ways that make them more productive, and they incorrectly think weought to do things that way for them.
 I sure hope this part is true:
You would things couldn’t get any worse. But they areworse, muchworse. I’ll just say one word. Google. Those bastards are practicallythe home page of the Internet. Which means, to a close approximation,they are the most popular application in the world.

And what have they taught our users? Full-text search wins. Please,don’t lecture me, we had this discussion way back when we talked aboutfields. Users know how to use Google. If you give them a search pagewith a field for searching the account number and a field for searchingthe SSN and a field for searching the zip code and a field forsearching the phone number, they want to know why they can’t just type4165558734 and find Reg by phone number? (And right after we make thatwork for them, those greedy and ungrateful sods’ll want to type (416)555-8734 and have it work too. Bastards.)

Suspended by the Baby Boss at Twitter

Well!  I'm now suspended from Twitter for stating that Elon's jet was in London recently.  (It was flying in the air to Qatar at the...