Securing Your APIs with OAuth 2.0 - API Days

In this talk, you’ll learn how to use OAuth 2.0 to secure access to your APIs. OAuth is an authorization protocol which enables applications to access data on behalf of users without needing to know their username and password. This enables many use cases such as easily enabling multi-factor authorization for your users, and better separation of concerns of all your backend services.

We’ll look at how to use JWT access tokens, as well as the tradeoffs that come with them. We’ll look at how to design scopes that allow granular access to various parts of your backend services. We’ll also look at how to design a microservices architecture protected by OAuth at a gateway.

---

Okta is a developer API service that stores user accounts for your web apps, mobile apps, and APIs.

[Chris.Plunkett]

This is a golden example of how a technical presentation should be. Great job!

[starman]

Presenter was clear in mind what he is talking! I am able to understand which I failed to uderstand from many other similar content. Thank you.

[mingzus]

not shortest one in YouTube, but one of the BEST to explain Oauth ! Thanks you !

[AnonyoX]

One of the best presentations on this topic. Lucid, on-point, and yet moderately detailed. Thank you, Aaron.

[ThePersepolis]

I already read some articles, but this was a perfect explanation.

[FictionsAndIllusions]

Thanks for this video. I was curious about how to secure Web APIs using OAuth2.0 and the second half of this talk answered it perfectly.

[joeyjoejoo]

that was an absolutely brilliant tutorial. thanks very much.

[sergiocamacho]

Excellent presentation. It wasn't hard at all to watch for a half-hour talk.

[sumitkumarbu]

Very nice presentation. Really helped!

[santiagocavanna]

Thanks for sharing this information.
I found it very clear and useful. I am doing some work as IAM Arch and not always it is clear the path.

[alirezaamedeo]

PKCE is not the replacement of client authentication. It's simply to prove whoever is exchanging code for token is the same guy who requested the code.

[mansimen]

Hi, great presentation, the hotel card analogy is quite good.

But IMHO, really poor choice of colors for the slides. I'm colorblind and don't see any difference between those arrows that you mentioned in slide at minute 10:39.

[domaincontroller]

Specs are not good tutorials, 20 specs 00:57 the password anti-pattern 02:23 OAuth spec, Sign in with 02:46 OAuth was designed to give access to data, accessing APIs not about identifying the user 04:15 OpenID connect 04:36 OAuth originally created for that third-party app access, first party app as well, gmail actually redirects you to the google OAuth server 06:24 we gonna take a look how OAuth works, from an application point of view 06:39 access token, hotel key 07:57 five roles 08:51 starting with the simplest flow 10:45

[alirezaamedeo]

You may not want to expose scopes of a JWT to the world so reference token will be the only option.

[allycdes]

It's couldn't care less, not could care less