AM & Access

OAuth 2.0

A delegated-authorization framework that lets an app get limited, scoped access to a user's resources on another service — without ever seeing the user's password.

aka: OAuth

OAuth answers “what is this app allowed to do,” not “who is this user” — an access token proves permission, not identity, which is why treating a raw OAuth token as proof of login is a well-known anti-pattern. That exact gap is what OpenID Connect was built to close on top of OAuth.