2018-05-02 UTC
# 
Zegnat jeremycherfas: the core difference between authentication and authorization is that authentication says “I am X” and authorization says “X gives permission to do Y”. So with your authentication done, an application can go to a /token endpoint/ and say “X says I should have permission for Y”, and if everything checks out it gets a /token/ that is proof of that.