Demystifying OAuth2 and OIDC

on YouTube ↗45m

" summary

Explains OAuth 2.0 and OpenID Connect as standards-based authorization flows, naming endpoints (/token, /introspect) and roles (resource owner, resource server, authorization server). Compares opaque tokens (revocable) vs JWTs (not revocable), shows grants like client_credentials for server-to-server and PKCE for public apps, and discusses refresh tokens, token lifetimes (recommend hours or a workday rather than 30 days), when to call introspection versus using an ID token, plus sequence diagrams (no live code).

AI-written summary · about

" chapters (6)

1. 0:00Introduction
2. 2:12OAuth2 and OIDC
3. 15:50OAuth2 transport analogy
4. 24:00OAuth2 flows and use cases
5. 34:54OpenID Connect vs OAuth2
6. 38:07Q&A

" related talks

• 33mOAuth and OpenID Connect Deep DiveTravis Spencer · Nordic APIs Stockholm 2013
• 47mIntroduction to OAuth 2.0 and OpenID ConnectPhilippe De Ryck · GOTO Berlin 2018
• 28mOAuth 2.0 and OIDCSara Daqiq · Silicon Valley Code Camp 2018
• 46mAn illustrated crash course for OAuth and OIDCDeepu K Sasidharan · Jfokus 2025
• 45mMastering OAuth 2.0 and OpenID ConnectLeonardo Micheloni · Codemotion Madrid 2025
• 19mOAuth and OpenID Connect in Plain EnglishNate Barbettini · GOTO Chicago 2020
• 49mUnderstanding OAuth 2.0 & OIDCStephanie Chamblee · Connect.Tech 2021
• 01h 00mImplementing OpenID Connect and OAuth 2.0 – Tips from the TrenchesDominick Baier · NDC Security Oslo 2020