OAuth flows revisited
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
choose the right OAuth 2.0 flow per scenario.
Planned topics
- User-facing apps (web, mobile, SPA): authorization code flow with PKCE; no implicit flow.
- Machine-to-machine: client credentials flow; there is no user.
- Delegated access ("on behalf of the user" across services): token exchange, or forwarding the user's token where policy allows.
- OIDC adds identity (ID token) on top of OAuth; access tokens are for APIs.
- Check current OAuth security guidance (for example the OAuth 2.1 draft and best-practice documents) before recording.
Draft outline details
Demonstration
table: scenario | flow | token holds.
Check your understanding
Which flow for a nightly job with no user?
Show answer
Client credentials.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.