php oauth2 服务器授权码授予

Question

I'm trying to create oauth2 server with php by this https://itnext.io/an-oauth-2-0-introduction-for-beginners-6e386b19f7a9 (Authorization Code Grant)

Everything works fine, I get access_token, but one thing is not clear - how does Resourse server identify a user if access_token is created without users credentials?

Answer 1

Your Resource server doesn't need the user credentials. It only need to check that de access_token is valid and them will do his treatment.

The access_token should contain some informations that will idendify the user.

For more details about Resource_server inside oauth2: link