Roles: resource owner, client, authorization server and resource server. The authorization code grant (with PKCE) is the main user-facing flow; client credentials covers service-to-service calls; the device authorization grant (RFC 8628) covers TVs and CLIs; refresh tokens renew access. OAuth is about authorization; OpenID Connect adds authentication on top.
RFC 9700, the OAuth 2.0 Security Best Current Practice (January 2025), retires the implicit grant and the resource owner password grant, requires PKCE for public clients and recommends it for all, demands exact redirect URI matching and recommends sender-constrained tokens. The OAuth 2.1 Internet-Draft consolidates those rules but was not yet an RFC in October 2026.