Protect your API with OAuth2
summary
Argues that OAuth2 is the correct way to protect APIs, with a concrete PHP recipe: use Composer, a server library like brentshaffer/oauth2-server, Slim + PDO storage and add grant types for password and authorization code. Demonstrates a working token endpoint, bearer header checks that return 401/200, a sample Slim bookshelf API, and using Guzzle or curl. Mentions JWT tokens for stateless validation, typical access-token lifetimes (≈20–60 minutes) and longer refresh tokens that exchange for new access tokens; implementation details and SQL migrations are provided.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:12Protect Your API with OAuth 2
- 10:18Password grant (for 1st party apps)
- 18:27Authorisation Code (for 3rd party apps)
- 29:56Refresh tokens
- 33:08Questions?
related talks
33mWhy you shouldn´t care about Security
27mThe Nuts and Bolts of API Security: Protecting Your Data at All Times
43m10 steps to build a strong Token based API Security
25mOAuth 2.1: The Future of API Security
20mBuilding a secure API: Overview of techniques and technologies needed to launch a secure API
20mOAuth 2: A closer look
56mSecuring an API Ecosystem with OAuth 2 0
27mSafeguard your precious API endpoints built on FastAPI using OAuth 2.0