What is OAuth 2.0, and what is it explicitly not?

An open standard for (delegated) authorisation that gives applications limited access to protected resources via access tokens; it is not an authentication protocol and says nothing about who the user is or how they logged in.

Key facts:

• Purpose: devices, APIs, servers and applications get limited access to protected resources by presenting an access token instead of the user's password.
• Format: standardised messages, JSON over HTTPS.
• Specification: RFC 6749 (the framework) and RFC 6750 (how bearer tokens are used).
• Foundation for other protocols: OpenID Connect, UMA 2.0 (User-Managed Access) and IndieAuth are built on top of it.

What it deliberately does not do: it delivers no information about the type of authentication or about the subject. An access token says "the bearer may read this user's photos", not "this request comes from Alice, who logged in five minutes ago with a password and a second factor". Treating OAuth as a login protocol is a classic mistake, which is exactly the gap OpenID Connect fills.

Tip: OAuth answers "what may this app do?"; OIDC answers "who is this user?".

Go deeper:

• RFC 6749: The OAuth 2.0 Authorization Framework — the normative definition, starting with the roles.
• OAuth (Wikipedia) — history from OAuth 1.0 to 2.0 and the main uses.
• OktaDev: OAuth 2.0 and OpenID Connect (in plain English) — the standard one-hour explainer of both protocols.