Blog Series
The Complete OAuth & OIDC Guide
From OAuth 1.0 to OIDC, PKCE, JWT, and Keycloak — a coherent path through modern authentication and authorization, written for engineers and interview prep.
5 Parts 1 Sections
Start with Part 1 →
Series curriculum
OAuth 1.0
- Part 1 Why Delegated Authorization? Understand the fundamental problem OAuth was created to solve — why giving your password to a third-party app is dangerous, what delegated authorization means, and the key difference between authentication and authorization.
- Part 2 Credential Model A deep dive into the seven credentials in OAuth 1.0 — Consumer Key, Consumer Secret, Request Token, Request Token Secret, OAuth Verifier, Access Token, and Access Token Secret. Understand who creates each, what it proves, and why every one is necessary.
- Part 3 Authorization Flow Walk through the complete OAuth 1.0 authorization flow from registration to protected resource access — with consistent concrete examples, callback URL mechanics, the verifier, and the browser's role at every stage.
- Part 4 Request Signing A deep dive into OAuth 1.0 request signing — why bearer tokens aren't enough, how HMAC-SHA1 signatures work, the complete signing process, provider-side verification, nonces, timestamps, replay attacks, and why signing doesn't replace HTTPS.
- Part 5 Security & Interview Prep The final part of the OAuth 1.0 deep dive — secret compromise analysis, OAuth 1.0 vs 1.0a differences, architectural comparison with OAuth 2.0, and a comprehensive categorized interview question bank from beginner to advanced.