https://www.shkcorp.com/blog Practical notes on product management, distributed systems, and AI—written from real engineering and product experience. en-us kshameed7@gmail.com (Hameed Syed K) kshameed7@gmail.com (Hameed Syed K) Thu, 22 Oct 2026 00:00:00 GMT https://www.shkcorp.com/blog/iam-chapter-6-oauth-part-2 https://www.shkcorp.com/blog/iam-chapter-6-oauth-part-2 Which OAuth flow for which app, and how each one is kept safe: the Authorization Code flow end to end, PKCE for apps that cannot hide a secret, Client Credentials for machine-to-machine jobs, why implicit and password grants were retired, and why a token is not a login. Thu, 22 Oct 2026 00:00:00 GMT kshameed7@gmail.com (Hameed Syed K) iamoauthpkceclient-credentialssecuritystudy-notes