Authentication & authorization, from the wire up.
Auth Mechanics is a free, browser-based learning environment for understanding how identity systems behave—not just memorizing protocol names.
What you can learn
The curriculum spans human authentication, API authorization, OAuth and OpenID Connect, passkeys, JWT validation, DPoP, SPIFFE workload identity, OPA, OpenFGA, token exchange, MCP authorization, delegated agent access, and troubleshooting.
How the lessons work
Each lesson uses simulated requests and responses, step-by-step explanations, failure scenarios, and a checkpoint quiz. No real credentials are used and no live identity provider is contacted.
Privacy and architecture
The core site is static HTML, CSS, and JavaScript. Lesson progress is stored locally in the browser. The interactive simulations do not require an account, database, API key, or application backend. See the Privacy notice for details about local storage, hosting, analytics, and search tools.
Contact
Questions, corrections, or feedback? Email contact@authmechanics.dev. Messages are used only to respond and improve the site as described in the privacy notice.