Glossary
OAuth 2.0
OAuth 2.0 lets a user grant a third-party application access to a specific resource — a calendar, a file store, an account balance — without giving that application the user's password. Instead, the user authorizes the application through the resource's own identity provider, which then issues the application a token scoped to just what was approved.
The framework itself is a set of flows for obtaining that token; it does not, on its own, say anything about what the token is good for once issued. The application receiving it is still responsible for treating the token as a sensitive credential and for not requesting more scope than the task actually requires.