Authorization framework enabling applications to obtain limited access to user accounts. Delegates authentication to the identity provider without sharing credentials.