title: oauth2 - How does resource server know if user authorized?
body: <p>I've been reading articles on google but none of them explained the problem to me. There is this image in the digitalocean's article that I would like to use to explain:</p>
  
  <p><a href="https://i.stack.imgur.com/TfNZd.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/TfNZd.png" alt="enter image description here"></a></p>
  
  <p>So I don't understand steps 5and 6. When auth server returns access token, this is used to retrieve data from resource server. But how does resource server know if the access token is really valid? Does it ask authorization server if token is valid?</p>
  
  <p>For example, what will happen if I come up with some random access token and send a request to resource server with this token? How does it know that the token is not valid?</p>