Oleg Dulin Oleg Dulin. OAuth 2.0 authorization flow. The third-party app is unaware of the user’s credentials. You, as the resource owner, own your data stored on the resource server.