Typorithm · hard

OAuth2 & OIDC

oauth-oidcsecurityoauthoidcauthorization-code

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn OAuth2 & OIDC

Auth & Identity

OAuth2 delegates authorization by issuing access tokens; OIDC layers authentication on top, returning an id_token (a JWT). The authorization-code flow swaps a short-lived code for tokens, public clients add PKCE, and scopes limit access. Avoid the legacy implicit flow.

OAuth2 is an authorization framework: instead of handing your password to an app, you let an authorization server issue it a scoped access token. The flow begins by redirecting the user to /authorize with response_type=code, the client_id, and the scopes being requested.

After the user consents, the server redirects back with a short-lived authorization code, which the app exchanges at /token (grant_type=authorization_code) for an access token — and, when the openid scope is present, an id_token. That access token is then sent as Authorization: Bearer ... to call protected endpoints like /userinfo.

OpenID Connect (OIDC) layers authentication on OAuth2: the id_token is a JWT proving who the user is. Public clients (SPAs, mobile apps) can't keep a secret, so they add PKCE to bind the code to the requester. Scopes keep tokens least-privilege, and the legacy implicit flow should be avoided.

OAuth2 = authorization; OIDC adds authentication (id_token).

Authorization-code flow swaps a code for tokens at /token.

Public clients add PKCE; avoid the implicit flow.

GET /authorize?response_type=code&client_id=app&scope=openid
POST /token grant_type=authorization_code code=AUTH_CODE
GET /userinfo Authorization: Bearer ACCESS_TOKEN
# use PKCE for public clients

Read the implementation

Connect each part of the code to the concept before you type.

1. Authorization request

The user is sent to /authorize; response_type=code starts the authorization-code flow.

GET /authorize?response_type=code&client_id=app&scope=openid

2. OIDC scope

The openid scope turns an OAuth2 request into an OpenID Connect one, asking for an id_token.

scope=openid

3. Token exchange

The short-lived code is exchanged at /token for access and id tokens.

POST /token grant_type=authorization_code code=AUTH_CODE

4. Use the token

The access token is sent as a Bearer credential to call a protected endpoint.

GET /userinfo Authorization: Bearer ACCESS_TOKEN

5. PKCE

Public clients (SPAs, mobile apps) add PKCE so an intercepted code can't be redeemed.

# use PKCE for public clients

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.