Glossary

Authorization Server

The authorization server asks resource owners for their consensus to let client applications access their data. It also manages and issues the tokens needed for all the authorization flows supported by OAuth2 spec. Usually the same application offering resources through an OAuth2-protected API also behaves like an authorization server.

Resource Server

An application providing access to its own resources through an API protected following the OAuth2 spec.

OpenID Connect Provider

An Authorization Server that also implements OpenID Connect, issuing ID tokens and exposing the discovery, JWKS, and userinfo endpoints. Django OAuth Toolkit acts as an OpenID Connect Provider (OP) when OIDC_ENABLED is set.

Relying Party

An OpenID Connect Client (RP) that relies on an OpenID Connect Provider to authenticate resource owners — that is, the OIDC specialization of the OAuth2 Client role. Django OAuth Toolkit’s own client-side helpers live in oauth2_provider.client, named for the OAuth2 role (see Package Layout). Note that “RP” also appears in the names of OpenID Provider endpoints that serve external relying parties (RP-Initiated Registration and Logout); those are provider code, not client code.

Application

An Application represents a Client on the Authorization server. Usually an Application is created manually by client’s developers after logging in on an Authorization Server.

Client

A client is an application authorized to access OAuth2-protected resources on behalf and with the authorization of the resource owner.

Resource Owner

The user of an application which exposes resources to third party applications through OAuth2. The resource owner must give her authorization for third party applications to be able to access her data.

Access Token

A token needed to access resources protected by OAuth2. It has a lifetime which is usually quite short.

Authorization Code

The authorization code is obtained by using an authorization server as an intermediary between the client and resource owner. It is used to authenticate the client and grant the transmission of the Access Token.

Authorization Token

A token the authorization server issues to clients that can be swapped for an access token. It has a very short lifetime since the swap has to be performed shortly after users provide their authorization.

Refresh Token

A token the authorization server may issue to clients and can be swapped for a brand new access token, without repeating the authorization process. It has no expire time.