NOTE
OAuth 2.x
Delegated authorization with resource owner, client, authorization server, resource server, scopes, access tokens, and secure redirect flows.
This is a historical learning note and may contain outdated or incomplete understanding.
OAuth is an authorization delegation framework: a client obtains an access token from an authorization server and uses it to access protected resources within granted scope.
OAuth is not authentication by itself. Browser/public-client flows require strong redirect-URI validation and modern proof mechanisms such as PKCE where applicable. Client secrets are meaningful only for clients that can actually keep them confidential.
Access-token format can be opaque or structured; resource servers should validate according to the authorization-server contract rather than assuming every OAuth token is a JWT.