I do not grasp the concept of the first steps in the OAuth process: Authorisation Request and Authorisation Grant. As far as I know:

1. User wants to access client by authorizing Service API

2. User clicks e.g "Log in with Github" and gets redirected to Service API's website

3. User authorizes client by clicking e.g "Authorize Client"

4. Service API sends client an approval of authorisation grant

5. Client uses authorization grant to request token

6. Service API returns access token

7. Client uses access token to request protected resources

8. Service API sends back resources

9. Client displays resources to user

Is this process flow correct? I am particularly confused about the role of the user in requesting/granting authorization.

I do not grasp the concept of the first steps in the OAuth process: Authorisation Request and Authorisation Grant. As far as I know:

1. User wants to access client by authorizing Service API
2. User clicks e.g "Log in with Github" and gets redirected to Service API's website
3. User authorizes client by clicking e.g "Authorize Client"
4. Service API sends client an approval of authorisation grant
5. Client uses authorisation grant to request token
6. Service API returns access token
7. Client uses access token to request protected resources
8. Service API sends back resources
9. Client displays resources to user

Is this process flow correct? I am particularly confused about the role of the user in requesting/granting authorisation.