OAuth, IndieAuth, and the Future of Authorization APIs
summary
OAuth 2.0 plus a web identity layer that treats users and apps as URLs enables third‑party apps to post to personal sites using the standard authorization code flow: discover an authorization endpoint (e.g. indieauth.com), get an authorization code, exchange it at a token endpoint for a bearer access token, then POST to a Micropub endpoint to create content. Implementations use microformats2 and multipart/form data for photos, return 201 with a Location header, avoid shared secrets, and require HTTPS.
AI-written summary · about
chapters (4)
- 0:00OPEN SOURCE BRIDGE
- 10:24How does this work?
- 18:19Example: a "notes" app
- 31:28Creating other types of content
related talks
44mThe Art of Authentication for Web Apps
16mHow to build a website for the IndieWeb
18mPapers Please! A Non-Dystopian Look at Modern Authentication
58mOAUTH, OPENID CONNECT & .NET – THE GOOD PARTS
54mOAuth – the good Parts
58mOAuth – the good Parts
46mA Deep Dive into the Past, Present & Future of OAuth
25mOAuth 2.1: The Future of API Security