How Salesforce uses connected apps to provide authorization for external API

This authorization is based on scopes associated with the corresponding connected app in Salesforce. With a successful authorization code grant flow, Salesforce sends an access token to the client app. The client app sends its access token to the API gateway, requesting access to the protected order status data.