Not all OAuth2 tokens are made equal: user vs app tokens explained

This article clarifies a common point of confusion in OAuth2: the distinction between user tokens (representing a person via authorization_code grant) and app tokens (representing an application via client_credentials grant). It explains how each type affects access control, using an email client example to illustrate on-behalf-of flows versus service account scenarios. The article also touches on JWT claims like 'sub' to show how tokens encode the principal's identity. Aimed at developers and IT professionals, it provides practical insight into designing secure APIs and understanding identity principals in modern authentication systems.