A photo-printing app, with the user's permission, reads the user's photos stored on another company's photo storage service. In OAuth 2.0, which of the following roles shows the user a screen asking for permission and, when the user agrees, issues an access token to the app?

Answer: B. Authorization server

OAuth 2.0 has four roles: the resource owner (the user), the client (the photo-printing app), the authorization server and the resource server (the API that returns the photos). The authorization server confirms the user and obtains consent, then issues the client an access token limited in scope and lifetime. The client calls the resource server's API with the token, and the resource server checks the token and returns the photos. The user does not have to give the app the password for the photo storage service and can also revoke the permission later.

• A. The resource server is the side that checks the token and returns the resources (the photos). Tokens are issued by the authorization server.
• B. Correct. It obtains the user's consent and issues the access token.
• C. The client is the side that receives the token and calls the API (the photo-printing app).