SevyDevy

Design an oauth 2.0 authorization server API

PremiumAPI designHard

  • Oauth 2.0
  • PKCE
  • Authorization code flow

Quick answer

This API design interview question asks you to design an oauth 2.0 authorization server API. Aim for a design that exposes a clear, consistent and safe interface, then explain the resources, requests, responses and error handling. Interviewers want to see how you name resources, version the interface and handle failure cases.

The problem

Design an OAuth 2.0 authorization server API, like the one behind "Sign in with Google" for third-party apps: users approve scopes and apps get tokens instead of passwords. The hard parts are a secure authorization code flow with PKCE, refresh token rotation and token checks on every API call.

A productivity platform wants third-party apps to access user data on the user's behalf. Design the authorization endpoint, the token endpoint, consent, scopes, refresh, introspection, revocation and client registration. Follow OAuth 2.0 and OpenID Connect where they apply, and be exact about parameters, responses and errors.

What must an oauth 2.0 authorization server API do?

  • Authorization code flow with PKCE: Apps redirect the user to authorise; the server returns a short-lived code; the app exchanges it for tokens.
  • Tokens: Access tokens for API calls, refresh tokens to get new access tokens, ID tokens for sign-in (OpenID Connect).
6 more requirementsUnlock to see all

How well must it do it?

  • Security: Codes are single-use and expire in 60 seconds; redirect URIs match exactly; refresh tokens rotate and detect reuse.
  • Latency: Token endpoint under 100 ms at p95; resource servers validate access tokens without a network call on the hot path.
2 more requirementsUnlock to see all

What scale should you design for?

Use these numbers in your estimates.

The scale numbers unlock with this questionUnlock

Key concepts

  • Oauth 2.0
  • PKCE
  • Authorization code flow
  • Refresh token rotation
  • OpenID connect
  • Token introspection

How you’ll practise

6 short steps · save and come back any time
  1. Use cases
  2. Resources
  3. Endpoints
  4. Errors, auth and limits
  5. Versioning
  6. Wrap-up

Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.

What do interviewers look for?

In any API design round.

  • Starts from the clients and the use cases
  • Names resources and operations consistently
  • Defines request and response shapes and status codes
  • Covers authentication, rate limits and idempotency
  • Plans pagination, filtering and versioning
  • Explains how clients learn about and recover from errors

Questions people ask about this interview question

Which design type is this question?
It is an API design question. You design an oauth 2.0 authorization server API and explain your choices the way you would in an interview.
Is this question asked at entry level?
It is marked Hard. It suits engineers preparing for senior interviews, where you are expected to drive the discussion and go deep on trade-offs.
What should I cover first?
Start with the clients, the main use cases and the resources they need. Agree on scope with the interviewer before you design anything.
Can I practise it for free?
It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.

Related questions

Updated · Written by the SevyDevy team

Premium questionSign up free, then unlock it