Explaining OAuth with LinkedIn: parties, the sign-in flow and why passwords stay private

Describe how OAuth works when LinkedIn is involved. Explain who takes part, what happens step by step from the moment a person clicks a social sign-in button, what the app ends up holding, and why the person's password is never handed to the other side. Pitch the explanation for a product interview: correct about the mechanics, and clear about what each step means for the member. ```hint Map the parties before the steps Before describing any step, list every party the flow touches and what each one has at the start. Then trace each message from the click onward, noting who sends it and who receives it. ``` ### Clarifying Questions - Do you mean LinkedIn acting as the provider, as when another website offers sign-in with LinkedIn, or LinkedIn acting as the app that relies on another provider, as when someone joins LinkedIn with a Google account? - Is the purpose to sign the person in, or to let an app act on their LinkedIn data, such as reading the profile or posting on their behalf? - How deep should I go: only what the member sees on screen, or also the messages the systems exchange behind it? ### What a Strong Answer Covers - The parties involved, what each one holds or controls, and any setup needed before a member ever clicks - The end-to-end flow in order, including what travels through the browser and what goes server to server - What the app ends up holding, why that is safer than sharing the password, and what limits apply to that access - How granting access to data differs from proving the member's identity at sign-in - Risks the flow must defend against, and what each step means for the member's sign-in experience ### Follow-up Questions - After signing in, the member no longer wants the app connected to their LinkedIn account. What can they do, what happens the next time the app calls the API, and how should the app respond? - How would the flow change for a native mobile app instead of a website with its own server, and why? - As the PM for a sign-up page, how would you decide which permissions to ask for at sign-up and which to ask for later?