EXPLORE THE KNOWLEDGE BASE

OAuth & OpenID Connect

Go deep on grants, endpoints, metadata, tokens, claims, DPoP, PAR, RAR, logout, and the threats they address.

15 articlesStart with the foundations

Understand delegated API access, the main actors, and the role of access tokens.

Choose the right OAuth grant, understand public and confidential clients, and compare client authentication methods.

A reference to the authorize, token, introspection, revocation, UserInfo, JWKS, PAR, device, registration, and logout endpoints.

Authorization server metadata, OpenID discovery, Protected Resource Metadata (RFC 9728), and dynamic client registration.

Learn what the identity layer adds to OAuth and why an ID token differs from an access token.

Flows, scopes, request parameters, the UserInfo endpoint, subject types, and the four logout mechanisms.

Registered JWT claims, ID token claims, access token claims, standard user claims, and confirmation and delegation claims.

Read a JSON Web Token's structure and apply the checks that decide whether a token can be trusted.

Compare by-value and by-reference access tokens, their trade-offs, and hybrid patterns such as the phantom token.

Accept bearer and DPoP tokens, validate them, return standard errors, request step-up authentication, and publish metadata.

How Demonstrating Proof of Possession binds tokens to a client key, with proof structure, nonces, errors, and trade-offs.

Push authorization requests to the server (RFC 9126) and sign them as JWTs (RFC 9101) for integrity, confidentiality, and early validation.

Express fine-grained, structured permissions with authorization_details when scopes are not enough.

Device flow, token exchange, mutual TLS, CIBA, JWT bearer grants, OAuth 2.1, and FAPI — and where to read about DPoP, PAR, and RAR.

The attacks described in the OAuth Security BCP and the controls that prevent them.