What is OAuth2, and what roles do the Authorization Server, Resource Server, and Client play? | Interview Question

Advanced Spring Security

OAuth2 is an authorization framework letting a user grant a third-party application limited access to their resources without sharing their actual credentials. The Authorization Server authenticates the user and issues access tokens. The Resource Server hosts the protected data/API and validates incoming tokens before granting access. The Client is the application requesting access on the user's behalf. Spring Security provides dedicated modules for building each role — `spring-boot-starter-oauth2-resource-server` for validating tokens, `spring-boot-starter-oauth2-client` for acting as a client, and Spring Authorization Server for building your own token-issuing server.

Advanced7 min

In most real setups, a Spring Boot API doesn't issue tokens itself — it delegates authentication entirely to a dedicated identity provider (Okta, Auth0, Keycloak, Azure AD) acting as the Authorization Server, and the Spring Boot app only plays the Resource Server role: validating incoming JWTs against that provider's public keys. This is a much smaller, more common integration than building a full Authorization Server, which is why `spring-boot-starter-oauth2-resource-server` alone covers the majority of real-world Spring Security OAuth2 usage.

A Spring Boot App Is Very Often Only the Resource Server, Not the Authorization Server