Secure your APIs using OAuth2 and OpenID Connect
summary
Title claims that API keys are insufficient and demonstrates OAuth2 + OpenID Connect applied to finance with concrete mechanics: code flow, access tokens short lived with refresh tokens as ticket granting tickets, distinction between by-value JWTs and reference tokens dereferenced by a gateway into JWTs, use of introspection endpoint and a live demo using Curity plus BankID showing token issuance and successful introspection, and a recommendation to move toward proof‑of‑possession holder‑of‑key tokens.
AI-written summary · about
chapters (10)
- 0:00Start
- 2:16API Security != API Keys
- 4:02The Neo-security Stack
- 12:32Scopes
- 15:08Profiles of Tokens
- 16:31Types of Tokens
- 17:27JWT Tokens
- 18:39Passing Tokens
- 26:42ID Token is for Client
- 27:47User Info Endpoint
related talks
27mThe Nuts and Bolts of API Security: Protecting Your Data at All Times
18mSecure your Apps and APIs with strong authentication and Adaptive Access.
27mIntegrating API Security Into A Comprehensive Identity Platform
31mOAuth 2.1 And OpenID Connect
47mIntroduction to OAuth 2.0 and OpenID Connect
33mOAuth and OpenID Connect Deep Dive
56mSecuring an API Ecosystem with OAuth 2 0
27mSafeguard your precious API endpoints built on FastAPI using OAuth 2.0