A computer-implemented method, comprising: receiving a request through a first website associated with a first system, the request initiated by a user through a computing device; redirecting the computing device of the user from the first website associated with the first system to a second website associated with a second system,the computing device being operated by the user to log into the second website and be authenticated by the user's credentials; presenting an access grant page from which the user can select one or more grants; receiving at an authorization system, from the second system, access grant data comprising a user identifier associated with the user and at least one grant selected from the access grant page; generating, with at least one processor of the authorization system, an authorization code in response to receiving the access grant data; encrypting, with the at least one processor, the authorization code with a public key associated with the first system, resulting in an encrypted authorization code; transmitting the encrypted authorization code from the authorization system to the second system's website, the second website redirecting back to the first website with the encrypted authorization code, and the first website sending the encrypted authorization code to the first system (108, 256); receiving, at the authorization system from the first system, a digitally signed authorization code generated by the first system based on the authorization code and a private key corresponding to the public key associated with the first system; verifying, with the at least one processor of the authorization system, the digitally signed authorization code based on the public key and the authorization code; in response to verifying the digitally signed authorization code, transmitting an access token from the authorization system to the first system, wherein the access token is configured to authorize a user with the first system; receiving, at the authorization system from the first system, a digitally signed access token generated by the first system based on the access token and the private key; verifying, with the at least one processor, the digitally signed access token based on the public key and the access token; verifying, with the at least one processor of the authorization system, an authorization of the first system is active by comparing the access token to a revocation list to determine that the token is still valid, wherein the revocation list indicates access tokens that have been revoked by the user through the second website; and in response to verifying the digitally signed access token and verifying that the authorization of the first system is active, authorizing the first system to invoke one or more services of the second system on behalf of the user. receiving a request through a first website associated with a first system, the request initiated by a user through a computing device; redirecting the computing device of the user from the first website associated with the first system to a second website associated with a second system,the computing device being operated by the user to log into the second website and be authenticated by the user's credentials; presenting an access grant page from which the user can select one or more grants; receiving at an authorization system, from the second system, access grant data comprising a user identifier associated with the user and at least one grant selected from the access grant page; generating, with at least one processor of the authorization system, an authorization code in response to receiving the access grant data; encrypting, with the at least one processor, the authorization code with a public key associated with the first system, resulting in an encrypted authorization code; transmitting the encrypted authorization code from the authorization system to the second system's website, the second website redirecting back to the first website with the encrypted authorization code, and the first website sending the encrypted authorization code to the first system (108, 256); receiving, at the authorization system from the first system, a digitally signed authorization code generated by the first system based on the authorization code and a private key corresponding to the public key associated with the first system; verifying, with the at least one processor of the authorization system, the digitally signed authorization code based on the public key and the authorization code; in response to verifying the digitally signed authorization code, transmitting an access token from the authorization system to the first system, wherein the access token is configured to authorize a user with the first system; receiving, at the authorization system from the first system, a digitally signed access token generated by the first system based on the access token and the private key; verifying, with the at least one processor, the digitally signed access token based on the public key and the access token; verifying, with the at least one processor of the authorization system, an authorization of the first system is active by comparing the access token to a revocation list to determine that the token is still valid, wherein the revocation list indicates access tokens that have been revoked by the user through the second website; and in response to verifying the digitally signed access token and verifying that the authorization of the first system is active, authorizing the first system to invoke one or more services of the second system on behalf of the user.