An authorization server is the OAuth service that authenticates a resource owner, obtains consent, and issues tokens to a client. It lets applications access approved API resources without receiving the user’s password. In ACME’s scenario, the Customer Authentication Service authenticates Kate, records her approved scopes, and issues BI Explorer a limited token; the Customer Collaboration API later evaluates that token and its policies. section 11.2.1
An authorization-code flow typically proceeds as follows:
- The client starts the connection and redirects the user to the authorization server with readable scope descriptions. section 11.2.3
- The authorization server authenticates the user and displays the requested scopes for consent. section 11.2.3
- After approval, it redirects the browser with a short-lived authorization code. section 11.2.3
- The client exchanges the code directly with the authorization server over a secure back channel for an access token. section 11.2.3
BI Explorer’s limited access
Kate approves workspace-membership and document-metadata scopes for BI Explorer but declines event subscriptions. The resulting token represents only the access she selected, allowing the application to analyze permitted data without learning her ACME password. section 11.2.1 section 11.2.3
