Topolearn

Learn OAuth, OIDC & JWT

Delegated authorization, single sign-on and signed tokens for web APIs

16 lessons · 3 hours · 4 levels · covers OAuth, OIDC & JWT OAuth 2.0 + RFC 9700 security BCP, OIDC Core 1.0, JWT (RFC 7519)

OAuth 2.0 lets applications obtain limited access to APIs on a user's behalf without seeing their password; OpenID Connect adds a standard identity layer for login and single sign-on; JSON Web Tokens are the signed token format both commonly use. Together they secure almost every modern web, mobile and machine-to-machine API, so understanding the flows and their pitfalls is essential for backend and frontend engineers alike.

Sign in free to track progressOfficial docs ↗

Before you start

OAuth, OIDC & JWT builds on these; the tree links to the exact lessons you need.

Node.jsEssentials levelcurlEssentials level

How deep do you want to go?

1. EssentialsRead and write simple code, do the everyday basics6 lessons · 1 hour in total
2. PracticalUse it productively at work, with the usual idioms10 lessons · 2 hours in total
3. AdvancedThe less common features, performance and trade-offs13 lessons · 3 hours in total
4. ExpertInternals and the edge cases experts know16 lessons · 3 hours in total

The OAuth, OIDC & JWT tree

OAuth, OIDC & JWTWhat OAuth solves: roles and delegationWhat OAuth solves:roles and delegationJWT structure and claimsJWT structure andclaimsAuthorization code flowAuthorization codeflowPKCEPKCEAccess tokens, refresh tokens and scopesAccess tokens,refresh tokens and…OpenID Connect: ID tokens and loginOpenID Connect: IDtokens and loginClient credentials for servicesClient credentials forservicesValidating JWTs with JWKSValidating JWTs withJWKSProtecting an API: scopes and claimsProtecting an API:scopes and claimsSPAs, mobile apps and the BFF patternSPAs, mobile appsand the BFF patternPOST, PUT and forms: -d, -X, -FPOST, PUT andforms: -d, -X, -FJSON APIs and authenticationJSON APIs andauthenticationEnvironment variables and .env filesEnvironmentvariables and .env f…
Essentials and Practical shown (10 of 16 lessons); the full list is below. Click a lesson to read it.

All 16 lessons, in order

Foundations

  1. What OAuth solves: roles and delegation · Essentials · 10 min

    OAuth 2.0 delegates limited API access to an application via tokens, with four roles: resource owner, client, authorization server, resource server.

Tokens and JWT

  1. JWT structure and claims · Essentials · 12 min

    Read a JSON Web Token: base64url header, payload of registered claims, and a signature that proves integrity, not secrecy.

  2. Access tokens, refresh tokens and scopes · Essentials · 12 min

    Use short-lived bearer access tokens with scopes on API calls, and refresh tokens to get new ones without bothering the user.

  3. Validating JWTs with JWKS · Practical · 15 min

    Verify JWT signatures against the issuer's JWKS, pin the algorithm, and check iss, aud, exp and typ before trusting any claim.

  4. Rotation, revocation and introspection · Advanced · 12 min

    Rotate refresh tokens with reuse detection, revoke tokens at logout, and introspect opaque tokens when you need live status.

Grant types and flows

  1. Authorization code flow · Essentials · 15 min

    Walk through the redirect-based authorization code grant: authorize request, user consent, code callback and token exchange.

  2. PKCE · Essentials · 10 min

    Bind the authorization code to the client that started the flow with a code verifier and its S256 challenge.

  3. Client credentials for services · Practical · 10 min

    Let a backend service get its own access token with the client credentials grant, with no user involved.

  4. Device flow and token exchange · Advanced · 12 min

    Log in on TVs and CLIs with the device authorization grant, and swap tokens between services with token exchange.

OpenID Connect

  1. OpenID Connect: ID tokens and login · Essentials · 12 min

    Add the openid scope to get an ID token that tells the client who logged in, plus the userinfo endpoint for profile data.

  2. OIDC discovery, nonce and logout · Advanced · 15 min

    Configure clients from the discovery document, validate ID tokens fully, and implement RP-initiated and back-channel logout.

Protecting APIs and apps

  1. Protecting an API: scopes and claims · Practical · 12 min

    Turn validated tokens into authorization decisions with scopes, roles and resource ownership checks in API middleware.

  2. SPAs, mobile apps and the BFF pattern · Practical · 15 min

    Choose where tokens live for public clients: native apps with system browsers, and SPAs via a backend-for-frontend.

Security hardening

  1. JWT attacks and hardening · Expert · 15 min

    Recognize alg=none, algorithm confusion, kid and jku injection, and cross-JWT confusion, and apply the JWT best practices (RFC 8725).

  2. Sender-constrained tokens: DPoP and mTLS · Expert · 15 min

    Bind access and refresh tokens to a client key with DPoP proofs or mutual TLS so stolen tokens are useless.

  3. OAuth security best practice (RFC 9700) · Expert · 15 min

    Apply the current OAuth threat model: exact redirect matching, PAR, mix-up defence, no implicit or password grants, and OAuth 2.1.