7 min read
IAM Chapter 5: OAuth 2.0, Part 1
Letting an app act for you, without handing over your password. The authorization code flow walked step by step, why the code is useless without a client secret, and the access-token-as-hotel-key-card analogy that makes refresh tokens click.