OAuth – the good Parts
summary
OAuth has a first major revision after 10 years: OAuth 2.1 removes obsolete flows and standardizes two practical paths — machine-to-machine (client_credentials with client id/secret) and interactive (authorization code + refresh tokens). Access tokens commonly use JWTs but access tokens are opaque to clients; APIs validate signatures, expirations (typical lifetime one hour) and scopes. Refresh tokens let long sessions be renewed and can be revoked to cut access; 401 means expired token, 403 means insufficient authorization. OpenID Connect adds the ID token for authentication.
AI-written summary · about
chapters (9)
- 0:00Introduction to OAuth
- 3:32History and motivation
- 6:46Why OAuth exists
- 12:43Architecture and terminology
- 17:14Understanding scopes
- 21:41Machine-to-machine flow
- 33:50Authorization code flow
- 45:35Application architectures
- 50:09OpenID Connect and conclusion
