OAuth is Not User Authorization

In the same way that OAuth is not authentication, it also does not tell us what the user is allowed to do or represent that the user can access a protected resource (an API). Understanding what OAuth is not is just as important as knowing what it is, in order to use it effectively.