How the connection is made

A client finds the server by asking the site where its protected resource lives. The answer points at an authorization server, which is the site itself.

The four steps

• The client registers itself. No account, no shared secret.
• The site shows a consent page behind its normal login.
• You choose what the client may do, and confirm.
• The client receives a token that is scoped to that choice.

The token can be revoked from the site at any time, and revoking it takes effect immediately.