This is a simulation. PhotoProvider is not a live OAuth server. Each step is authored so you can watch one message move.
Use Next and Previous under the player. A click plays that step, then pauses. Click an arrow to read that message in the sidebar.
What the diagram is showing
Application registration happens before OAuth starts. PhotoProvider assigns consumer_key photo-app-123 and consumer_secret SECRET_APP. Those credentials are configured on PhotoApp’s server. The secret never goes in the browser or in a redirect.
The protocol begins with a signed POST /oauth/request_token. PhotoProvider returns a temporary request token. PhotoApp then redirects Alice’s browser to PhotoProvider. Alice authenticates there and clicks Allow. PhotoProvider redirects back with a verifier, and PhotoApp exchanges the request token for an access token. The request token, its secret, and the verifier are spent. ACCESS_123 stays active.
PhotoApp calls GET /photos with a signature. SECRET_APP and the access-token secret stay on the server. Only the signature travels.
Links under a step open the signing, credential, replay, and security scenes. Those scenes return to this flow.