1. OAuth 2.0 Tutorial
2. OAuth 2.0 Overview
3. OAuth 2.0 Roles
4. OAuth 2.0 Client Types
5. OAuth 2.0 Authorization
6. OAuth 2.0 Endpoints
7. OAuth 2.0 Requests and Responses
8. OAuth 2.0 Authorization Code Requests and Responses
9. OAuth 2.0 Implicit Requests and Responses
10. OAuth 2.0 Resource Owner Password Credentials Grant - Requests and Response
11. OAuth 2.0 Client Credentials Grant - Requests and Response

OAuth 2.0 defines the following roles of users and applications:

• Resource Owner
• Resource Server
• Client Application
• Authorization Server

These roles are illustrated in this diagram:

OAuth 2.0 roles as defined in the specification.

The resource owner is the person or application that owns the data that is to be shared. For instance, a user on Facebook or Google could be a resource owner. The resource they own is their data. The resource owner is depicted in the diagram as a person, which is probably the most common situation. The resource owner could also be an application. The OAuth 2.0 specification mentions both possibilities.

The resource server is the server hosting the resources. For instance, Facebook or Google is a resource server (or has a resource server).

The client application is the application requesting access to the resources stored on the resource server. The resources, which are owned by the resource owner. A client application could be a game requesting access to a users Facebook account.

The authorization server is the server authorizing the client app to access the resources of the resource owner. The authorization server and the resource server can be the same server, but it doesn't have to. The OAuth 2.0 specification does not say anything about how these two servers should communicate, if they are separate. This is an internal design decision to be made by the resource server + authorization server developers.