An illustrated crash course for OAuth and OIDC
summary
Clear rules for which OAuth flow to use: authorization code with PKCE for almost everything, implicit and resource‑owner password grants are deprecated, client‑credentials for machine‑to‑machine, device authorization for TVs and input‑constrained devices, refresh tokens stay on backends. Claims and scopes are key, tokens are mostly JWTs. Demonstrates a concrete tool JWT UI (Rust) — open source terminal encoder/decoder that validates signatures locally and does not send data, and recommends OAuth 2.1 / OIDC adoption.
AI-written summary · about
