Modern API Authentication 101
summary
The talk explains replacing one global user token with delegated OAuth2: use short-lived signed JWT access tokens plus server-held refresh tokens to avoid painful revocations. It details the GitHub-style authorization code flow (authorization code exchanged for access token, redirect_uri and state checks), and shows how services validate JWTs locally with a shared signing key or public key for stateless, scalable validation while handling revocation via token rotation or short TTLs and server-side refresh tokens.
AI-written summary · about
chapters (10)
- 0:00API authentication intro
- 1:21Scaleway's auth evolution
- 4:10API token: how it works and limits
- 11:49OAuth 2.0 delegation
- 24:30JWT: structure and crypto
- 31:57JWT security best practices
- 35:35JWE: encrypting JWT tokens
- 39:07Token revocation
- 40:52Scaleway's auth choices
- 42:37Q&A
related talks
58mOAuth – the good Parts
44mThe Art of Authentication for Web Apps
01h 02mOAuth in 2021 – What’s up?
43m10 steps to build a strong Token based API Security
25mOAuth 2.1: The Future of API Security
01h 00mOAuth – the good Parts
42mFrom Basic Auth to OAuth: Migrating security
47mDeconstructing and Evolving REST Security