Identity: who are you?
Authentication checks who a person is. Authorization checks what that person may do. This lesson explains the first check.
Open interactive lesson →Interactive curriculum
Learn identity by seeing the wire traffic.
Browse 40 interactive lessons covering authentication, authorization, browser sessions, SAML and SCIM, OAuth, OpenID Connect, passkeys, JWT validation, token lifecycle and protection, workload identity, policy, delegation, MCP, and agent authorization. No signup or backend required.
Course orientation
Learn how the simulator works, how to read the message flows, when to use Guided versus Explore mode, and what the 40-lesson path covers.
Read this before Lesson 1 →Permissions & scopes
A signed-in person may have permission to read an order without having permission to change it. Check both the action and the specific order.
Open interactive lesson →Hypertext Transfer Protocol (HTTP) Basic
HTTP Basic places an encoded username and password in a request header. Hypertext Transfer Protocol Secure (HTTPS) protects that header while it travels across the network.
Open interactive lesson →Application programming interface (API) keys
An API key is a shared secret that identifies a calling application or project. Send it only over Hypertext Transfer Protocol Secure (HTTPS), keep it out of addresses and logs, and limit what it can access.
Open interactive lesson →Bearer tokens
A bearer token lets its holder request the access that the token permits. The application programming interface (API) still validates the token and checks the requested operation.
Open interactive lesson →OAuth clients & authentication
Public clients cannot safely keep a shared secret. Confidential clients can authenticate to the authorization server with protected credentials when the server supports them.
Open interactive lesson →Client credentials
The client credentials grant lets a service obtain an access token using its own identity. No person needs to sign in for this request.
Open interactive lesson →Session cookies & cross-site request forgery (CSRF)
A secure session cookie can keep a user signed in, but browsers attach cookies automatically. State-changing requests need defenses against cross-site request forgery (CSRF) in addition to session authentication.
Open interactive lesson →Passkeys & multifactor authentication (MFA)
Passkeys replace reusable passwords with site-bound public-key credentials. Learn why that resists phishing, how sign-in works, and when a user-verified passkey can satisfy multifactor authentication (MFA).
Open interactive lesson →Enterprise single sign-on
Security Assertion Markup Language (SAML) lets an enterprise identity provider send a signed authentication assertion to a service provider. This can support enterprise single sign-on (SSO).
Open interactive lesson →Enterprise account provisioning
System for Cross-domain Identity Management (SCIM) standardizes user and group lifecycle management over Hypertext Transfer Protocol (HTTP). Single sign-on handles authentication; provisioning decides whether an account and its assignments should exist.
Open interactive lesson →OAuth 2.0 with Proof Key for Code Exchange (PKCE)
The user signs in at the authorization server. The application receives a code, then proves it is the same client that started the flow by using Proof Key for Code Exchange (PKCE).
Open interactive lesson →Redirect address, state & nonce
OAuth clients must use registered redirect addresses and verify correlation values. OpenID Connect also uses a nonce value to connect an identity result to the sign-in request that created it.
Open interactive lesson →OpenID Connect
OpenID Connect, or OIDC, adds a standard authentication result to OAuth. It uses an ID token to tell the application about the user’s sign-in.
Open interactive lesson →OpenID Connect UserInfo & claims
OpenID Connect defines a UserInfo endpoint that can return approved claims about the signed-in person. The client calls it with an access token and checks that the subject matches the identity result it already trusted.
Open interactive lesson →OpenID Connect logout & session termination
OpenID Connect supports coordinated logout patterns, but an application session, an identity-provider session, and sessions at other applications are separate things. Ending one does not automatically end all of them.
Open interactive lesson →Step-up authentication
A resource server can reject a token whose authentication context is too weak or too old, then tell the client what stronger authentication is required before retrying.
Open interactive lesson →Command-line browser sign-in
A command-line interface (CLI) can open the system browser for user sign-in, then receive the authorization result through a local callback or another approved return mechanism.
Open interactive lesson →Device code
A device or command-line app without a usable browser can display a code. The user signs in and approves access on another device.
Open interactive lesson →JavaScript Object Notation (JSON) Web Token (JWT) validation & key sets
A JavaScript Object Notation (JSON) Web Token (JWT) is a signed claims format. A JSON Web Key Set (JWKS) publishes public keys an issuer can use for signature verification.
Open interactive lesson →Audience & resource indicators
Scope says what access is requested; a resource indicator identifies where the client intends to use the token. The resource server must reject tokens not meant for it.
Open interactive lesson →Token introspection
An opaque token does not reveal usable claims to the application programming interface (API). Token introspection lets an authorized API ask the authorization server whether that token is currently active.
Open interactive lesson →OAuth token revocation
The OAuth 2.0 Token Revocation standard lets a client ask the authorization server to revoke a refresh or access token. The practical effect depends on token type, grant relationships, and how resource servers learn that access changed.
Open interactive lesson →Expiry, refresh & logout
Access tokens expire. A refresh token may let the client request a replacement. Logout and revocation require separate actions.
Open interactive lesson →Refresh token rotation
With refresh token rotation, each successful refresh returns a new refresh token and invalidates the one just used. Reuse of an older token is a signal that the token family may have been stolen.
Open interactive lesson →Demonstrating Proof of Possession (DPoP) tokens
Demonstrating Proof of Possession (DPoP) binds an access token to a key held by the client. Each protected request includes a fresh signed proof, so a copied token alone is not enough.
Open interactive lesson →Pushed & rich authorization requests
Pushed Authorization Requests (PAR) move authorization details to a direct client-to-server request before the browser redirect. Rich Authorization Requests (RAR) let a client describe structured access needs instead of relying only on short scope strings.
Open interactive lesson →Mutual Transport Layer Security & bound tokens
Mutual Transport Layer Security (mTLS) lets both sides of a connection authenticate with certificates. OAuth can bind an access token to the client certificate so a copied token cannot be used without the matching private key.
Open interactive lesson →Workload identity credentials
The Secure Production Identity Framework for Everyone (SPIFFE) defines workload identities. A SPIFFE Verifiable Identity Document (SVID) carries that identity in a form another workload can verify.
Open interactive lesson →Workload identity federation
Secure Production Identity Framework for Everyone (SPIFFE) federation lets one trust domain validate selected workload identities from another domain by trusting the other domain’s published verification material.
Open interactive lesson →Policy with Open Policy Agent
Open Policy Agent (OPA) evaluates policy rules using facts supplied by the application. The application must give OPA trustworthy input and must enforce the result that comes back.
Open interactive lesson →OpenFGA relationships
OpenFGA supports relationship-based access control. An application programming interface (API) can ask whether a user has a required relationship to a specific object before returning that resource.
Open interactive lesson →Tenant & delegation boundaries
A tenant is a customer or organization using a shared service. An application programming interface (API) must check the user’s tenant, the resource’s tenant, and the permissions delegated to any acting service or agent.
Open interactive lesson →Token exchange
The OAuth 2.0 Token Exchange standard lets a service request a token for another application programming interface (API) while identifying the user and the service acting for that user.
Open interactive lesson →Cross-domain OAuth
Organization B can exchange a token from organization A for a token that B’s application programming interface (API) accepts. B decides which identities, resources, and permissions it will allow.
Open interactive lesson →Remote Model Context Protocol · 2026
Model Context Protocol (MCP) connects artificial intelligence (AI) applications to tools and resources. This lesson uses the modern 2026-07-28 Streamable Hypertext Transfer Protocol (HTTP) and authorization model.
Open interactive lesson →Agent delegation
An agent host runs software that can call tools for a user. Its requests must remain within the user’s grant and the server’s access rules.
Open interactive lesson →Biscuit tokens
A Biscuit holder can create a more restricted token without contacting the issuer. A receiving application programming interface (API) must verify the token chain and every restriction before allowing access.
Open interactive lesson →Putting it together
An agent checks inventory in a partner organization and reads an approved quote. Six parts show sign-in, delegation, policy checks, restricted tokens, results and renewal.
Open interactive lesson →Troubleshooting lab
Inspect a rejected application programming interface (API) request. Decide whether the problem is the credential, its intended API, or the permission for the action.
Open interactive lesson →