A standard for access delegation: a client gets a token from an authorization server and uses it to access a resource on a server, which validates the token.