On the Web, authentication is vital. Particularly with Open APIs, applications are relying more and more on resources that are spread all across the Web. Very few service providers offer APIs without some form of security or authorization. Some service providers just want to identify the consuming application via an API key, while others that deal with more sensitive user information have finer-grained authorization mechanisms such as OAuth.

To put OAuth into context, consider the following scenarios:

It’s great to utilize all these resources, but in order for these applications to access user data on other sites, they ask for usernames and passwords. Not only does this require exposing a user’s password to some random application on the Web, but also provides these applications unlimited access to do as they wish.