First, the user displays intent towards the consumer. Then the consumer seeks permission from the service provider and receives a token & secret. When the consumer uses the secret, the service provider can validate that the request is truly coming from the consumer application.2. After that, the consumer redirects the user to the service provider for authorization. When the user reaches the service provider, the service provider shows the user which permissions the consumer is requesting. 3. When the user authorizes the token, the service provider gives the consumer an access token and secret. The consumer is now able to access the protected resource.