title: OAuth 2.0 for API server and mobile application
body: <p>I have a server and a mobile application. The server provides a RESTful API and the mobile application consumes this API. I wanted to use OAuth 2.0 so that only authorised users can get response, or, in other words, the mobile app gets an access token when the user logs in so that it can make API calls with this token.</p>
  
  <p>Normally, OAuth is used in a scenario a resource owner (like me), resource server (like Facebook) and client (some third party app) exist. In my case, there are only the server and the mobile app. I want to use my user's username&amp;password if required to get access token. My questions are as follows:</p>
  
  <ol>
  <li>I am not sure what roles my server and my application correspond to?</li>
  <li>What kind of flow (and/or Authorization Grant) should I implement?</li>
  </ol>