Authorize a set of resources
02In the code flow, resource indicators apply to the full authorization grant. A later token request can select a smaller audience under server policy.
Another configured server requires an explicit resource and returns invalid_target to the client through the authorization response. No grant is issued.
Source for this drawing: RFC 8707 · Read RFC section 2.1 ↗
New to this? Start hereA quick picture + helpful background
A key is different from permission.
An app, a person, and a server have different roles. Follow who asks, who grants permission, and who checks the credential. A key in the drawing is an analogy, not a literal protocol field.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The authorization grant and one access token have different scopes of use.
- A code-flow authorization request can repeat resource to request calendar and contacts. The authorization server applies resource-owner authorization and its policy; these fields do not themselves grant access.
- For a JWT authorization request, one resource value is a JSON string and multiple values are an array of strings. The diagram shows selected JSON members only, not a signed JWT or proof of verification.
- If resource is omitted, the server MAY use no specific resource, MAY choose a predefined default, or MAY require an explicit resource and fail with invalid_target. Unparseable or unacceptable resources should be rejected with invalid_target; optional error_description can explain why.
The short query is only the resource-parameter portion of a complete authorization request; normal client_id, response_type=code, redirect_uri, state and PKCE protections remain required by their applicable rules. This guide uses code flow and does not recommend the RFC’s historical implicit-flow example.
Read the RFC section ↗