Key Terminologies in OAuth

In the last What is OAuth blog , i shared an example of greet.com app accessing contact details for the user from another app and how the OAuth process works at high level.

In this blog, i will share some key terminologies of OAuth by referring to the example shared in last blog.

• Resource/Protected Resource: is the resource which the user is trying to access or is protected. In this example it is the contact list
• Resource Owner: in this example is the user whose contact list is being accessed. It is an entity capable of granting access to a protected resource
• Resource Server: is the server hosting the resource . In our example it is the web server hosting contactlist.com web app
• Client: is the application requesting for access on behalf of the user, in our example it is the greet.com web app requesting access for contact list on behalf of the user who is logged in.
• Authorization Server: is the server handling all the authorization requests and giving access tokens. It can be a separate server or can be part of the resource server.
• Scope: Scopes are the permissions that are allowed to the user . In our use case, scope allowed are only accessing the contact email list and not any other details like profile picture etc. These are coded by the application developer when writing the application.
• OAuth Tokens: Access tokens are the token the client uses to access the protected resource. This represents the authorization of a specific application to access specific parts of a user’s data.They’re meant to be short-lived.

Thank You !