Four roles, one delegation
01An app receives limited authority instead of the resource owner’s password.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 1.1 ↗
RFC 6749 · § 1.1EXAMPLE
4 / 4
04
Access the protected resource.
The resource server enforces the token’s authorization.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Separate the client from the resource owner.
- The owner controls resources; the client requests access; the authorization server issues tokens; the resource server checks them.
- OAuth 2.0 is an authorization framework. Login identity assertions are a separate layer.
The original abstract flow separates requesting permission, obtaining a credential, and using it.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
PrivacyAll chapters in this RFC
- Four roles, one delegation
- Public and confidential clients
- Two endpoints, two channels
- Authorization code grant
- Implicit grant: historical behavior
- Password grant: now prohibited
- Client credentials and extension grants
- Token responses and failures
- Refresh without another prompt
- Scope and protected resources
- Native apps and security boundaries