The /authorize endpoint is used to interact with the resource owner and get the authorization to access the protected resource. If those scopes are authorized by the user, then the access token will represent these authorized scopes. When an application authenticates with Auth0, it specifies the scopes it wants. The permissions represented by the access token, in OAuth terms, are known as scopes.

Then the client uses the access token to access the protected resources hosted by the resource server.ДЄuth0 generates access tokens for API authorization scenarios, in JSON web token (JWT) format. Access tokens are issued to third-party clients by an authorization server with the approval of the resource owner. Instead of using the resource owner's credentials to access protected resources, the client obtains an access token-a string denoting a specific scope, lifetime, and other access attributes. In OAuth, the client requests access to resources controlled by the resource owner and hosted by the resource server and is issued a different set of credentials than those of the resource owner. OAuth introduces an authorization layer and separates the role of the client from that of the resource owner. The OAuth 2.0 authorization framework is a protocol that allows a user to grant a third-party web site or application access to the user's protected resources, without necessarily revealing their long-term credentials or even their identity. OAuth 2.0 Authorization Framework In this article

What is identity api scope approval ui