Recap: OAuth 2.0 and OpenID Connect

OAuth grants an app limited access; OpenID Connect adds who the user is; the code flow with PKCE suits every client.

OAuth hands an application a limited token instead of a password, and OIDC tells it who signed in.

Four roles: resource owner, client, authorization server, resource server.
The code flow with PKCE: a code through the browser, exchanged with the verifier for tokens.
Client credentials: a service acting for itself, with no user.
Scopes limit what a token allows; ask for the least, and check them on every request.
OpenID Connect adds the ID token, for the client, checked with its nonce.
Three tokens: access for the API, ID for the client, refresh for the token endpoint.
OAuth is a framework; JWT is a format. They combine rather than compete.
Implicit and password grants are retired; use the code flow with PKCE.

The code flow with PKCE and OpenID Connect, with the ID token marked

← → move through sections and cards