OAuth 2.0 and OpenID Connect

OAuth 2.0 lets an application act on a user's behalf with limited scopes; OpenID Connect adds login on top of it. They power 'Sign in with Google' and API access tokens.

Where it shows up in real systems

  • Identity provider

    Handles passwords, MFA and social login, then issues short-lived tokens. Services that call it on every request inherit its latency and availability; validating signed JWTs locally avoids that dependency.

    In production: Auth0, Keycloak, Amazon Cognito, Microsoft Entra ID, Okta

See it break, then fix it

Build an architecture, send it a day of traffic and outages, and learn why it holds or fails. Free to start.