How to protect an API with OAuth

OAuth is a well-known standard for delegating authentication and authorization decisions to a central identity provider. Doing so allows your application to ignore the authentication and authorization process and allows the identity provider to focus on what it does best, finding out if a user is who they say they are and figuring out the authorization level that user has.

As a developer writing an API, you have a token when a grant completes.

But what happens then? This talk will discuss client and server-side code and logic needed when calling an API after you have an access token. This will include how to store a token in the API client, refresh a token using the refresh grant, and what your API code should examine when presented with a token.

Presented by Dan Moore, Head of Developer Relations at FusionAuth.