I wrote this about a decade ago and find it helpful for me in understanding how OAuth 2 actually works.

I posted a link to it at https://news.ycombinator.com/item?id=35718816 and lots of people found it helpful, so I thought it would be good for it to have its own discussion.