# authorization-server

Source: https://startwithidentity.com/glossary/authorization-server/
Last updated: 2026-09-21
License: content by Start with Identity. Cite the source URL.

---

In OAuth 2.0, the component that authenticates the resource owner, obtains their authorization, and issues access tokens to clients. It exposes the authorization and token endpoints and, in OpenID Connect deployments, also acts as the OpenID Provider issuing ID tokens.

The distinction between an authorization server and an identity provider is worth keeping straight even though one product usually does both. The authorization server's job is delegation: deciding what a client may do on a user's behalf and issuing a token scoped to it. Identity provision is authentication: asserting who the user is. Ory's architecture makes the split explicit by running an OAuth server that holds no user credentials at all.

See also: [OAuth](https://startwithidentity.com/glossary/oauth/), [access token](https://startwithidentity.com/glossary/access-token/), [scope](https://startwithidentity.com/glossary/scope/), [identity provider](https://startwithidentity.com/glossary/identity-provider/), [relying party](https://startwithidentity.com/glossary/relying-party/), [authorization server metadata](https://startwithidentity.com/glossary/authorization-server-metadata/), [protected resource metadata](https://startwithidentity.com/glossary/protected-resource-metadata/), [token introspection](https://startwithidentity.com/glossary/token-introspection/), [dynamic client registration](https://startwithidentity.com/glossary/dynamic-client-registration/), [Client ID Metadata Document](https://startwithidentity.com/glossary/client-id-metadata-document/)