OAuth2.0 is a delegation protocol where the Client (Mobile App or web app) does not need to know about the credentials of Resource Owner (end-user).  Oauth2 defines four roles.  Resource Owner - The person or the application that owns the data to be shared. When a resource owner is a person, it is called as an end-user. Resource Server - The application that holds the protected resources. It is usually a microservice. Authorization Server - the application that verifies the identity of the resource owner (users/clients). These server issues access tokens after obtaining the authorization. Client - the application that makes a request to Resource Server on behalf of Resource Owner. It could be a mobile app or a web app (like stackoverflow).