---
metadata:
- name: generator
content: Diplodoc Platform v5.44.0
alternate:
- https://yandex.com/dev/id/doc/en/concepts/ya-oauth-intro.md
- https://yandex.com/dev/id/doc/ru/concepts/ya-oauth-intro.md
---
> **Documentation Index:** Fetch the complete configuration index at https://yandex.com/dev/id/doc/en/llms.txt
# OAuth implementation at Yandex
Yandex services use tokens to authorize apps by the [OAuth 2.0](http://tools.ietf.org/html/rfc6749#section-4.4) protocol. Each token is a digit-letter sequence in which the following information is encrypted:
* ID of the account that can be accessed.
* ID of the app with access permissions.
* Set of permissions (actions available to the app).
The general rules for using Yandex OAuth tokens are described below.
## Authorization procedure {#authorization-scheme}
Applications request tokens the following way:
1. The application directs the user to the OAuth server. On the page that opens, the OAuth server can allow the application to access the requested account data. The app can ask for permissions that were set when [registering the app](https://yandex.com/dev/id/doc/en/register-client.md#access): {#step-1}
* All access rights specified when registering the app. In this case, the user can only allow or deny all requested permissions at once.
* Only the access rights currently needed from the list defined when the application was registered. In this case, the user can also allow or deny only all requested accesses at once.
* The access rights that are currently needed from the list defined when the application was registered, and optional rights from the same list that aren't required. For example, portrait access can be optional. In this case, the user can allow all requested necessary accesses at once and choose which of the requested optional accesses to allow.
1. The user allows access to their data, and the OAuth server redirects them to the address chosen by the developer: [Redirect URI](https://yandex.com/dev/id/doc/en/register-client.md).
The issued [token](https://yandex.com/dev/id/doc/en/access.md) or the [code](https://yandex.com/dev/id/doc/en/codes/code-and-token.md) for receiving it is included in the redirect URL. If an error occurred, the URL includes the error description.
1. The application includes the token received in the request to the Yandex service that supports OAuth.
The received token can be saved in the app and used for requests until its lifetime expires.
## Token lifetime {#ttl}
The token lifetime is the period during which the token can be used for authorization. The maximum lifetime depends on the rights selected when [registering the application](https://yandex.com/dev/id/doc/en/register-client.md#access):
Renewable token
: Expires after a few months, but is renewed every time you log in with this token.
When registering the app, the minimum lifetime is displayed, such as at least 1 year.
Restricted token
: Expires after the time set for the corresponding access rights.
If several such rights were selected when registering the app, the token is set to the lowest lifetime limit.
## Revoking the token {#token-recall}
The user can revoke any OAuth tokens issued for their account:
* To revoke tokens issued for an account, the user needs to change the password or [log out on all computers](https://yandex.com/support/id/profile.html).
* To revoke the tokens issued for a specific app, the user can disable its access on the [Data access rights](https://id.yandex.com/personal/data-access) page.
The app can revoke its own token if it was issued [for a specific device](https://yandex.com/dev/id/doc/en/tokens/token-invalidate.md#device-token).
All situations where tokens get revoked are listed in [Revoke a token](https://yandex.com/dev/id/doc/en/tokens/token-invalidate.md).
## User interface {#interface}
Page where the user can allow access to the application ([first step](#step-1) authorization), contains the application name and a list of requested rights:
When the user confirms login, the OAuth server redirects them to the address specified as the [Redirect URI](https://yandex.com/dev/id/doc/en/register-client.md).