Not all OAuth2 tokens are made equal: user vs app tokens explained

Understanding identity principals