What is the difference between OAuth2 Login, OAuth2 Client, and Resource Server in Spring Security?

Separates logging a user into an application, obtaining tokens for outbound calls, and validating access tokens on an API.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

OAuth2 Login makes the application an OAuth client that redirects a user to an authorization server and, commonly through OpenID Connect, establishes the user's login. OAuth2 Client support also manages authorized clients and access tokens when the application calls a downstream API. Resource Server support protects an API by validating bearer access tokens presented to it. These roles can coexist, but enabling one does not automatically configure the others.

Full answer below

Practice focus

OAuth2 and OIDC roles, client registration, login sessions, authorized clients, resource servers, access tokens, and boundaries.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
One application can play several OAuth roles, but each role has a different trust and token responsibility.
OAuth2 Login makes the application an OAuth client that redirects a user to an authorization server and, commonly through OpenID Connect, establishes the user's login. OAuth2 Client support also manages authorized clients and access tokens when the application calls a downstream API. Resource Server support protects an API by validating bearer access tokens presented to it. These roles can coexist, but enabling one does not automatically configure the others.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
An ID token describes an authentication event for the client and is not a general access token for arbitrary APIs. A resource server validates the access token's issuer, audience, time, and scopes rather than trusting a browser session from another application. Client secrets belong only to confidential server-side clients, and browser or native public clients use flows with PKCE. Token relay to downstream services is deliberate because the original audience and delegated scope may not fit.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Sending an ID token to every API.
Assuming OAuth2 Login secures a resource server automatically.
Putting a confidential client secret in browser code.

What is the difference between OAuth2 Login, OAuth2 Client, and Resource Server in Spring Security?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue the section

Tech stacks

Skill areas

Suggest an improvement

Found this answer useful?