Yes. But it’s authentication, whereas OAuth is authorization.

I kinda disagree. Authentication is at OAuths core. You still need to authenticate to obtain a token and in more complex setups you don’t use it for authorization at all because tokens are stale immediately after issuing them. It’s why things like Zanzibar and OPA have been made.

▲

9dev a day ago | parent [-]

It’s really not. OAuth makes zero assumptions about how you login - granted, the client credentials flow is a form of authentication if you will, but for the user perspective, OAuth starts when you’re signed in. That’s also why you can easily combine it with all kinds of authentication providers.

	▲	vips7L a day ago \| parent [-]
		> OAuth makes zero assumptions about how you login Neither does OIDC: "The methods used by the Authorization Server to Authenticate the End-User (e.g., username and password, session cookies, etc.) are beyond the scope of this specification." OAuth makes zero assumptions about a lot of things, like even how you "authorize". That doesn't mean that authentication doesn't play a crucial role. While it doesn't specify how you authenticate the user it still specifies that you must authenticate the user. Outside of the authorization code flow, other flows strictly mandate that you should authenticate the clients.