# Part 4 - The OAuth Authorization Server
OAuth Simplified 4 / 4
24 min read
How the Authorization Server registers clients, issues Authorization Codes and tokens, enforces PKCE, and what it stores and checks at every step.
/ tags/ Security
# Part 3 - The OAuth Protected Resource
OAuth Simplified 3 / 4
11 min read
How a protected resource validates Access Tokens, enforces scope, and uses token introspection so it has to trust nothing the client sends.
# Part 2 - The OAuth Client
OAuth Simplified 2 / 4
13 min read
How a client redirects the user, trades an Authorization Code for an Access Token, and uses the state parameter to shut down CSRF attacks.