title: OAuth - What exactly is a resource owner? When is it not an end-user?
body: <p>The term &quot;resource owner&quot; is defined in the <a href="https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-16#section-1.1" rel="nofollow noreferrer">OAuth v2.0 Specification</a>, as &quot;An entity capable of granting access to a protected resource.  When the resource owner is a person, it is referred to as an end-user.&quot;</p>
  <p>My question is, when is a resource owner not an end-user?  I would appreciate explanation through examples that could be real use cases.  For example, if the protected resource is a Facebook user's photo, is the <em>resource owner</em> Facebook or the Facebook user who uploaded the photo?  Also, why is the <em>resource owner</em> (that is also a person) be considered an end-user if that person is not even a user of the application that is implementing OAuth?  And, if the Facebook user is the resource owner, then what role does Facebook play in this exchange?</p>