OAuth 2.0 is primarily an authorization framework, not an authentication protocol.

It allows a resource owner to authorize a client application to access protected resources without giving the client the user's password.

Modern applications commonly use the Authorization Code flow with PKCE for user-facing clients.

OpenID Connect builds an identity layer on top of OAuth 2.0 and introduces concepts such as the ID token and UserInfo endpoint.

Important OAuth concepts include authorization server, resource server, client, resource owner, scopes, access tokens, refresh tokens, redirect URIs, PKCE, and consent.