The four roles

OAuth 2.0 Course · lesson 2 of 13 · 4 min read

Every OAuth diagram is confusing until you can name the four parties.

Open this lesson in the learning hub

Key points

  • Resource owner: you, the human who owns the data.
  • Client: the application asking for access. Confidential if it can keep a secret, public if it cannot.
  • Authorization server: authenticates you and issues tokens. Google, Auth0, Keycloak.
  • Resource server: the API holding the data, which accepts the token.
  • The auth server and resource server are often run by the same company but are different concerns.

Four roles: the user owns it, the client wants it, the auth server grants it, the API checks it.

The problem OAuth solves The authorization code flow

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the OAuth 2.0 Course course, and every lesson in it is listed on the OAuth 2.0 Course contents page.