The core OAuth2 spec defines so called flows, which are basically descriptions of the interactions between a client, a user and an authorization server to request access tokens. Another implied fact is, that the resource server and the authorization server … Continue reading Advanced OAuth2: Assertion Flow (why)