Access Token

The element that applications use to make API requests on behalf of a user; the access token represents the authorization of a specific application to access specific parts of a user’s data.

Authorization Server

The resource server hosts the protected user accounts. The authorization server verifies the identity of the user, then issues access tokens to the application.

Client

The application that wants to access the user’s account; before it may do so, it must be authorized by the user, and the authorization must be validated by the API.

Client Credentials

Applications themselves have to be authenticated and have their own credentials (e.g., username and password). This is to stop third parties from gaining access.

Grant Type

This is used to tell the Authorization server the type of workflow it will run to verify the credentials. Password and refresh_token, respectively, are used to get a new token or refresh one that has already been released.

Refresh Token

The Refresh Token grant type is used by clients to exchange a refresh token for an access token when the access token has expired. This allows clients to continue to have a valid access token without further interaction with the user.

Note: For programmatic access, refresh tokens are not used and a new token must be retrieved.

Resource Owner/User

The user who authorizes an application to access their account; the application’s access to the user’s account is limited to the scope of the authorization granted (e.g., read or write access).

Resource Server

The resource server handles authenticated requests after the application has obtained an access token.

Token Store

Tokens that have been released may be used across many systems. They are stored in a central easy-to-look-up location, or Token Store, behind the scenes of an API.

User Credentials

The actual username and password entered by the user