 <p>In v8.0, the client is able to retrieve information from the backend system because it passed the challenge presented to it, and in return received an access token that enables it to access resources that are protected by a scope, which you define. This is how OAuth works more or less.</p> <p>Have you read the Authentication Concepts tutorial? <a href="https://mobilefirstplatform.ibmcloud.com/tutorials/en/foundation/8.0/authentication-and-security/" rel="nofollow">https://mobilefirstplatform.ibmcloud.com/tutorials/en/foundation/8.0/authentication-and-security/</a></p>