Start with the mechanics, then learn the acronyms.
Auth Mechanics teaches identity by showing what actually moves across the wire, what each system checks, and how failures change the outcome. This short orientation explains the interface before Lesson 1.
New course · 40 lessons · progress saves in this browser.
Read the request. Watch the decision. Break the flow.
Step through a simulated exchange between browsers, clients, identity providers, authorization servers, APIs, and workloads.
Open the request, response, claims, and checks. The examples are deliberately simplified enough to learn from without hiding the important security decisions.
Try a failure scenario, observe what breaks, then use the checkpoint to confirm the mental model before moving on.
Choose Guided or Explore.
Guided mode keeps the recommended sequence and uses lesson checkpoints to unlock the next topic. Explore mode opens the full curriculum immediately so you can jump directly to SAML, OAuth, SPIFFE, MCP, or another topic you already need.
Your mode, theme, and lesson progress are stored only in this browser.
Follow the actors and the trust boundary.
The software initiating a request: browser app, CLI, service, or agent.
An IdP or authorization server authenticates a principal and may issue assertions or tokens.
An API or service validates presented evidence and enforces authorization.
Arrows represent protocol messages. The inspector shows the important fields and checks at each step.
Human identity → tokens → workload identity → delegated agents.
The 40 lessons move from authentication and permissions through browser sessions, enterprise SSO, OAuth/OIDC, token validation and protection, workload identity, policy engines, cross-domain delegation, MCP, and agent authorization.
You do not need to memorize every acronym up front. Focus on the repeated questions: Who is making this request? What evidence proves it? What resource is being requested? What action is allowed? What boundary should stop it?
Everything is simulated.
No real credentials are collected, no live identity provider is contacted, and the course does not require an account or backend. The examples are teaching models rather than production configuration templates.
Lesson 1: Authentication vs. authorization
Begin with the distinction every later lesson depends on: proving who someone is versus deciding what they may do.