Question: why oauth is not authentication?
Answer: Let's start with the biggest reason why OAuth isn't authentication: access tokens are not intended for the client application. When an authorization server issues an access token, the intended audience is the protected resource. ... It's down to the protected resource to understand and validate the token.