This is the server that has the secured resources in the form of hosted APIs. If we take Google or Facebook as an example, they hold the profile information, as well as other information, in the form of APIs. If the client application successfully authenticates (using the credentials provided by the user) and then the user grants appropriate permissions, they can get access to this information through their exposed APIs.