Integrating API Security Into A Comprehensive Identity Platform

on YouTube ↗27m

" summary

Explains how OAuth 2.0 plus OpenID Connect maps into an identity platform: use dynamic client registration to avoid hard-coded secrets, use the client credentials flow for machine-to-machine tokens and the authorization code flow (browser + one‑time code) for user delegation, and emit an ID token with at_hash and audience to prevent token substitution. Warns against implicit flow and homegrown auth APIs, recommends conformance tests and libraries; standards-based setup reduces credential exposure and centralizes authentication.

AI-written summary · about

" chapters (12)

1. 0:00Intro
2. 0:28Benefits
3. 2:04Value Proposition
4. 2:46Identity Platform
5. 4:33Peer Backchannel Pattern
6. 8:21API Keys
7. 9:00Risks
8. 10:17Pattern
9. 13:13Code Flow
10. 16:30Token Substitution Acts
11. 18:22ID Tokens
12. 22:38OpenIDNet Certification

" related talks

• 47mIntroduction to OAuth 2.0 and OpenID ConnectPhilippe De Ryck · GOTO Berlin 2018
• 42mA Step Toward Decentralization with OIDC!Vincent Chalamon · API Platform Conference 2023
• 36mTo Identity and BeyondBen Dechrai · PyCon India 2020
• 01h 02mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC Security Oslo 2019
• 19mIdentity:The missing link in API securityDavid Gorton · Platform Summit 2014
• 59mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Security Oslo 2020
• 01h 00mImplementing OpenID Connect and OAuth 2.0 – Tips from the TrenchesDominick Baier · NDC Security Oslo 2020
• 19mOAuth and OpenID Connect in Plain EnglishNate Barbettini · GOTO Chicago 2020