An authorization grant represents the resource owner's permission for a client to obtain an access token. In OAuth 2.0, the client exchanges the grant with the authorization server, then uses the resulting token to access protected resources. section 23.3.2 section 23.4
The authorization-grant flow proceeds as follows:
- The client requests authorization from the resource owner. section 23.3.2
- The resource owner grants permission, typically by logging in and approving access. section 23.3.2
- The client exchanges the authorization grant for an access token at the authorization server. section 23.3.2 section 23.4
- The client presents the access token to the resource server, which validates it and returns the permitted resource. section 23.3.2
Google Calendar delegation
A third-party calendar tool asks a user for permission to access Google Calendar data. After approval, the tool exchanges the authorization grant with Google’s authorization server, receives an access token, and requests calendar data from the resource server. section 23.3.2
Figure 23.7 The basic OAuth 2.0 process. Through access delegation, the client application is able to access the resource owner’s protected resources on behalf of the owner.
Use the OAuth 2.0 process diagram to follow delegation between the client, resource owner, authorization server, and resource server. section 23.3.2
