OAuth Patterns and Anti-Patterns

As OAuth evolved over the last decade, some of the spec's original elements were replaced by modern, more secure recommendations. These advancements along with the framework's already comprehensive foundation can be challenging to understand, let alone put into practice.

Securing access to APIs and other resources effectively under the OAuth 2.0 protocol requires first learning the components and tools it involves. After a brief rundown of OAuth terminology, this Refcard covers OAuth patterns and anti-patterns, with a particular focus on key security measures relating to client credentials, OAuth flows, access tokens vs. ID tokens, token validation, and more.