Introduction to OAuth 2.0 and OpenID Connect

on YouTube ↗47m

" summary

Explains how OAuth delegates access using an authorization server, shows three concrete flows: client credentials for machine-to-machine, authorization code grant for confidential back-ends (code exchanged server-to-server using client secret), and the implicit flow for browser apps; compares reference tokens with token introspection versus self-contained JSON Web Token claims; warns to use short-lived access tokens, never embed client secrets in front-ends, avoid implicit for back-end use, and use refresh tokens only for confidential clients.

AI-written summary · about

" chapters (10)

1. 0:00Introduction to OAuth
2. 2:50OAuth architecture
3. 5:58Client registration
4. 9:01Client credentials grant
5. 10:33Authorization code grant
6. 18:56Implicit grant flow
7. 23:57Token types and security
8. 28:42Using scopes in OAuth
9. 36:09Introduction to OIDC
10. 41:22OIDC flows and conclusion

" related talks

• 19mOAuth and OpenID Connect in Plain EnglishNate Barbettini · GOTO Chicago 2020
• 33mOAuth and OpenID Connect Deep DiveTravis Spencer · Nordic APIs Stockholm 2013
• 45mMastering OAuth 2.0 and OpenID ConnectLeonardo Micheloni · Codemotion Madrid 2025
• 45mDemystifying OAuth2 and OIDCNejmeddine Ben Ouarred · DevFest Toulouse 2025
• 28mOAuth 2.0 and OIDCSara Daqiq · Silicon Valley Code Camp 2018
• 27mIntegrating API Security Into A Comprehensive Identity PlatformPamela Dingle, Pam Dingle · Nordic APIs World Tour 2015
• 58mOAUTH, OPENID CONNECT & .NET – THE GOOD PARTSAnders Abel · NDC London 2024
• 58mOAuth – the good PartsDominick Baier · NDC Porto 2022