During this flow, the user provides access to their information from the Todo API to a third-party application. Here are the steps involved:

• Third-party application requests access to a specific user for the Todo API.
• The OAuth Server asks the user for permissions that they would want to allow the third-party application.
• User grants permissions for the third-party application to access their details in the Todo API. This is called an authorization grant.