An authorization flow is the sequence through which a client obtains permission and an access token to reach protected data. OAuth uses it to avoid sharing a user’s credentials while limiting access to selected scopes and a limited time. section 7.3
An OAuth flow connects four roles:
- The resource owner owns the data. section 7.3
- The client requests access on the owner’s behalf. section 7.3
- The authorization server manages identities and issues access tokens. section 7.3
- The resource server stores data and enforces access. section 7.3
Figure 7.5 OAuth describes flows through which users (resource owners) can authorize applications (clients) to access their data in an API (resource server). Every flow begins with an authorization request, followed by user login and consent and then by an access token grant.
The sequence begins with an authorization request, continues through user login and consent, and ends with an access-token grant. section 7.3
Admin API flow
An admin login endpoint requests an authorization code for a specific audience using the admin client. A token endpoint exchanges that code with the client secret, then protected endpoints validate the token and require an admin permission. section 8.6
