Let's get started

Up to this point, we have been talking about what OAuth 2.0 is, how it works, and how it is used around us. Now, we will finally be able to look at the process of becoming, and creating, an OAuth 2.0 client. It's really quite simple. The process of building our first OAuth 2.0 client can be broken down into these four easy steps:

1. Register your client application.
2. Get your access token.
3. Use your access token to access a protected resource.
4. If applicable, refresh your access token.

Tip

The ability to refresh your access token is only available for trusted clients. In order for a client application to refresh its access token, it must be able to securely store what is called a refresh token. This capability is only available to trusted clients, and therefore, the ability to refresh access tokens is restricted to trusted clients.

You may be wondering how untrusted clients renew their access. We will explain this in the Step 4 – Refresh your access token section later on in this chapter.

This process can be visualized simply with this diagram:

In terms of GoodApp, those steps would be:

1. Register the GoodApp application as a client for Facebook.
2. Using either the client-side flow or the server-side flow, get an access token.
3. Use this access token to get the user's friend list.
4. If we used the server-side flow and our access token has expired, use the refresh token to get a new access token.

As you can see, there isn't much to it! Let's start looking at each step a little more closely.