An authorization server issues authorization credentials, commonly access tokens, after a client or resource owner completes a separate authentication process. The client then presents the token to a resource server when calling a protected REST API. section 23.3.2 section 23.4
The operational sequence is:
- Authenticate the client or resource owner, often through username-and-password authentication. section 23.3.2
- Issue an access token, typically with a limited validity period. section 23.3.2
- Use the token in API requests to access protected resources; renew it when it expires. section 23.3.2 section 23.4
OAuth 2.0 access delegation
A client requests authorization from the resource owner, receives an authorization grant, exchanges it with the authorization server for an access token, and uses that token to access the resource server without receiving the owner’s credentials. section 23.4
Figure 23.6 REST API bearer authentication. A client obtains an access token from an authorization token and uses the token to access the desired resource on the resource server.
Shows the client obtaining an access token from the authorization server and presenting it to the resource server. section 23.3.2
