At some point, your APIs will need to allow limited access to users, servers, or servers on behalf of users.
Auth0's API authorization features allow you to manage the authorization requirements for server-to-server and client-to-server applications.
By using the OAuth 2.0 authorization framework, you can give your own applications or third-party applications limited access to your APIs on behalf of the application itself.
Using Auth0, you can easily support different flows in your own APIs without worrying about the OAuth 2.0/OpenID Connect specification, or the many other technical aspects of API authorization.
Which OAuth 2.0 flow should I use?
OAuth 2.0 supports several different grants. Deciding which one is suited for your case depends mostly on your Client's type, but other parameters weight in as well, like the level of trust for the Client, or the experience you want your users to have. Start here if you are not familiar with all that and you need directions in order to decide the proper flow for your case.
Configuring your tenant for the new API Authorization flows
If you want to unlock the new API Authorization scenario, you will need to enable a flag under your Account Settings. Read this doc for details.
Calling APIs from Server-side Web Apps
If your application executes on a server and you want to configure it to use OAuth 2.0 to access an API, read these docs.
Calling APIs from Mobile Apps
If your application is a native app and you want to configure it to use OAuth 2.0 to access an API, read these docs.
Calling APIs from Client-side Web Apps
Calling APIs from a Service
If you want to implement server-to-server interaction, and you want to configure it to use OAuth 2.0, read these docs.
Calling APIs from Highly Trusted Clients
If the application is highly trusted and no other grant can be used, read these docs. In this flow the end-user is asked to fill in credentials (username/password) typically using an interactive form. This information is later on sent to the Client and the Authorization Server. It is therefore imperative that the Client is absolutely trusted with this information.
Frequently Asked Questions on API Authentication and Authorization .