A resource server hosts protected API resources and grants access when a client presents a valid access token. In bearer authentication, the client obtains the token from an authorization server and sends it to the resource server instead of repeatedly transmitting credentials. section 23.3.2
The operational relationship is:
- The client obtains an access token from the authorization server. section 23.3.2
- The client presents the token when requesting the desired API resource. section 23.3.2
- The resource server uses the token to authorize access to its protected resources; HTTPS protects the token in transit. section 23.3.2
- A single server can sometimes perform both authorization-server and resource-server roles. section 23.3.2
Bearer-authentication flow
A client requests an access token, then uses that token to access an API hosted by the resource server. Intercepting the token could provide unauthorized access, so the exchange requires HTTPS. section 23.3.2
Figure 23.6 REST API bearer authentication. A client obtains an access token from an authorization token and uses the token to access the desired resource on the resource server.
Shows the client, authorization server, access token, and resource server in one bearer-authentication flow. section 23.3.2
