SecurityZines.com
What it is: OAuth 2.0 lets an app act on your behalf at another service (read your calendar, post to your repo) without ever seeing your password. You log in at the service itself and approve a limited scope.
The four roles: the resource owner (you), the client (the app), the authorization server (issues tokens) and the resource server (the API). The client ends up with an access token, and often a refresh token to get new ones.
Why it matters: OAuth is about authorization, not identity. Logging users in on top of it is what OpenID Connect adds. Most real-world bugs are redirect URI mistakes, leaked tokens and over-broad scopes.
