Building a secure API: Overview of techniques and technologies needed to launch a secure API
summary
Covers a practical neo security stack: OAuth 2 as delegation (not authentication), OpenID Connect for federation, JWTs as compact bearer tokens, and SCIM for user provisioning. Explains the web server flow with one-time code → access token + refresh token, how APIs get both client and user context for fine-grained allow/deny decisions, and shows combining SCIM and OAuth for just-in-time provisioning so SaaS apps can create and license users before first login.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:34API Security
- 5:20OAuth
- 9:52What is OAuth
- 11:34OAuth Stack
- 13:18OpenID Connect
- 15:28Jot
- 17:06Delegated Access
- 18:18In use cases
related talks
21mBuilding Neo-security Platforms: Securing APIs using modern standards
27mThe Nuts and Bolts of API Security: Protecting Your Data at All Times
18mAPI Security Simplified: A 5-Pillar Approach
29mAPI Security in 2017
41mAPI Security 2026: How Not to End Up on Have I Been Pwned?
32mSecuring Value in API Ecosystems
17mAPI Security Simplified: Practical Tips & Tools
27mIntegrating API Security Into A Comprehensive Identity Platform