Home/ Questions/Q 7938055
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-03T22:41:52+00:00

I’m new to OAuth and having trouble visualizing the process behind how it works.

  • 0

I’m new to OAuth and having trouble visualizing the process behind how it works.

From what I understand, when I attempt to verify credentials via OAuth, I send a request to the login server, which takes over and has the user log in on the site itself. If credentials were valid, the callback URL of the OAuth request is then visited, and a token is attached to the callback URL. This token must be passed with all future HTTP requests to the server, and serves as validation of the user’s credentials.

Where I am confused is, how do I adapt this process for a desktop application with no server? What do I use for a callback URL, and how do I retrieve the token if I’m just running a .NET application on my desktop?

Thanks!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It depends on what service providers you want to support.

    Google has a good description of how to use OAuth 2.0 with ‘installed applications’ here:
    https://developers.google.com/accounts/docs/OAuth2InstalledApp

    In general, there are a few different strategies:

    1. Do the OAuth flow as you described above– popping up a browser using a standard URL handler, but ask the user to copy/paste an authorization code from their browser back to your application. This requires support from the provider for a redirect_url of urn:ietf:wg:oauth:2.0:oob.
    2. Open the browser window, and capture the server’s returned authorization code from the browser’s title window automatically instead of requiring a copy/paste. This also requires support for the OOB redirect_url.
    3. Do the OAuth request within your app as an embedded browser window, and capture the authorization code as in #2.

    If your OAuth 2.0 provider doesn’t support OOB, you can also redirect to a web server which you own to accomplish a similar task.

    The biggest question is whether you’re doing this for authentication (getting the user’s identity) or authorization (getting access to the user’s data via a web API). If you’re trying to authenticate the user, you’ll need some server-side logic you can trust to pass the authorization code or access token for validation.

    • 0