OAuth2 & OIDC

OAuth2 is an authorisation framework: it lets an application act on a user's behalf without ever seeing their password. It is not an authentication protocol, and treating it as one is the source of a whole class of bugs.

OpenID Connect is the thin identity layer built on top. It adds an ID token — a JWT containing verified claims about who the user is — plus a userinfo endpoint and a standard discovery document. If you want to log someone in, you want OIDC. If you want to call an API on their behalf, you want OAuth2. Most real systems want both, which is why they arrive together.

The flows, and which to use:

Authorisation Code with PKCE is the answer for anything with a user — server-rendered apps, SPAs, and mobile. The client redirects to the provider, the user authenticates there, and an authorisation code comes back which the client exchanges for tokens. PKCE binds that exchange to the client that started it, so an intercepted code is useless. It is now recommended for confidential clients too, not just public ones.

Client Credentials is for machine-to-machine, where there is no user at all — a service authenticating as itself.

Device Authorisation covers input-constrained devices: a TV or CLI shows a code, you authorise on your phone.

Implicit and Resource Owner Password Credentials are both deprecated. Implicit returned tokens in the URL fragment where they leak into history and logs; the password grant requires the app to handle the user's actual credentials, defeating the point.

Tokens. An access token is a short-lived bearer credential — whoever holds it can use it, so treat it like a password in transit and at rest. A refresh token is longer-lived and exchanged for new access tokens, and should be revocable.

Validate properly on the resource server. Check the signature, the issuer, the expiry, and — the one most often skipped — the audience. Without an audience check, a token minted for a different service is happily accepted by yours.

Scopes bound what a token can do, and are not a substitute for checking that this user may act on this object.