Delegated authorization with multi-factor authentication

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for performing delegated authorization, including: maintaining resources associated with a resource owner; receiving an access request from a client application requesting access to the resources; performing a first authentication of the resource owner; determining that the first authentication was successful, and providing to the resource owner a request to delegate access to the resources to the client application; receiving a selection of one or more delegated access permissions for the one or more resources to be delegated to the client application; determining that at least one of the one or more delegated access permissions is for a critical resource, and performing a second authentication by requesting multi-factor credentials from the resource owner; authenticating the multi-factor credentials; determining that the second authentication was successful; and granting an access token to the client application permitting access the critical resource.