An authorisation framework (RFC 6749) in which a user or service grants an application scoped access to resources, receiving an access token instead of sharing credentials. It defines flows (grants) for different situations — authorization code for interactive apps, client credentials for service-to-service, device code for input-constrained devices. OAuth 2.0 handles authorisation only; OpenID Connect adds the authentication layer on top.