OAuth 2.0: authorization framework for delegated access. Flows: Authorization Code (web apps, most secure), PKCE (mobile/SPA, prevents code interception), Client Credentials (machine-to-machine), Implicit (deprecated, less secure). Roles: Resource Owner, Client, Authorization Server, Resource Server. OAuth provides authorization, not authentication (use OIDC for that).