Yes, Pega can act as an OAuth provider. You can create an OAuth 2.0 Client Registration data instance as part of the process to allow external applications such as Twitter, Facebook, and Google to securely access your REST services, without storing or disclosing individual users' names and passwords. You can get more information from the link below:

https://community.pega.com/sites/default/files/help_v721/procomhelpmain.htm

HI Ranga,

I am referring the "OAuth 2.0 Authorization framwork" with Auth code not just with access token. 

Pega should have an Authorization URL and access token URL(i see this URL). So external system invokes the Authorization URL so they will be redirected to pega login popup once they enter the login details the external system stores the Auth Code sent by Pega and it uses the Auth Code to get the Access Token to call the REST services. 

The Authorization framework am referring in the below link:

https://tools.ietf.org/html/rfc6749

In Pega7.2, we have OAuth2.0 Provider data instances where we can mention external systems Auth URL,token url. 

if you see the facebook URLs, they have below URLs. 

Authorization End Point : https://graph.facebook.com/oauth/authorize

Access token end point: https://graph.facebook.com/oauth/access_token

You can refer the OAuth2.0 Provider data instances in Pega7.2.

Pega 7 can act as an OAuth 2.0 client (consumer) and supports the client credentials and authorization code grant types.