23 min read
IAM Chapter 6: OAuth 2.0, Part 2
Which OAuth flow for which app, and how each one is kept safe: the Authorization Code flow end to end, PKCE for apps that cannot hide a secret, Client Credentials for machine-to-machine jobs, why implicit and password grants were retired, and why a token is not a login.