Editing OAuth 2.0 (section)

== Remembering (Knowledge / Recall) 🧠 ==
=== Core terminology & definitions ===
* '''[https://wikipedia.org/wiki/OAuth OAuth]''' – A family of authorization standards allowing a resource owner to grant limited access to client applications.
* '''[https://wikipedia.org/wiki/OAuth Authorization Grant]''' – A credential representing the resource owner's permission.
* '''[https://wikipedia.org/wiki/JSON_Web_Token JSON Web Token (JWT)]''' – A compact token format often used for access tokens.
* '''RFC 6749''' – The IETF specification defining OAuth 2.0.
* '''Client ID / Client Secret''' – Identifiers used by applications requesting authorization.

=== Key components / actors / elements ===
* '''Authorization Server''' – Issues tokens after authenticating and authorizing the user.
* '''Resource Server''' – Hosts protected API endpoints.
* '''Client Application''' – Requests access on behalf of the user.
* '''Resource Owner''' – The user controlling access to resources.

=== Canonical models, tools, or artifacts ===
* '''[https://wikipedia.org/wiki/OpenID_Connect OpenID Connect]''' – Identity layer built on top of OAuth 2.0.
* '''Bearer Tokens''' – Standard token type transmitted in HTTP headers.
* '''PKCE (Proof Key for Code Exchange)''' – Extension improving authorization code security.

=== Typical recall-level facts ===
* Introduced in 2012 (RFC 6749).
* Used by major platforms such as Google, Facebook, GitHub, and Microsoft.
* Focuses on authorization, not authentication.

----