Glossary

Authorization Server

The authorization server asks resource owners for their consensus to let client applications access their data. It also manages and issues the tokens needed for all the authorization flows supported by OAuth2 spec. Usually the same application offering resources through an OAuth2-protected API also behaves like an authorization server.

Resource Server

An application providing access to its own resources through an API protected following the OAuth2 spec.

Application

An Application represents a Client on the Authorization server. Usually an Application is created manually by client’s developers after logging in on an Authorization Server.

Client

A client is an application authorized to access OAuth2-protected resources on behalf and with the authorization of the resource owner.

Resource Owner

The user of an application which exposes resources to third party applications through OAuth2. The resource owner must give her authorization for third party applications to be able to access her data.

Access Token

A token needed to access resources protected by OAuth2. It has a lifetime which is usually quite short.

Authorization Code

The authorization code is obtained by using an authorization server as an intermediary between the client and resource owner. It is used to authenticate the client and grant the transmission of the Access Token.

Authorization Token

A token the authorization server issues to clients that can be swapped for an access token. It has a very short lifetime since the swap has to be performed shortly after users provide their authorization.

Refresh Token

A token the authorization server may issue to clients and can be swapped for a brand new access token, without repeating the authorization process. It has no expire time.