OAuth 2.0 defines four distinct roles to separate token authorization from resource handling:

1. Resource Owner: The entity capable of granting access to a protected resource (typically the end user).
2. Resource Server: The API server hosting the protected user resources, capable of accepting and responding to protected resource requests using access tokens.
3. Client: The application making resource requests on behalf of the Resource Owner with its authorization.
4. Authorization Server: The server issuing access tokens to the client after successfully authenticating the resource owner and obtaining authorization.