OAuth School

Learn OAuth by doing it.

Work through the OAuth 2.0 and OpenID Connect flows by hand: build the requests yourself, watch what the authorization server does with them, and paste the results back here to check your work.

Every learner gets their own practice authorization server, ready to go. There's no account to create and nothing to install. If you can use a browser and curl, you're all set.

Join a class

Exercises

  1. 1 Getting Started Meet your own authorization server, find its endpoints, and define a scope for your API.
  2. 2 OAuth for Web Applications The authorization code flow with PKCE, as a confidential client with a client secret.
  3. 3 OAuth for Single-Page Applications The authorization code flow with PKCE, as a public client with no secret.
  4. 4 OAuth for Machine-to-Machine Applications The client credentials grant, for a backend service with no user.
  5. 5 Refresh Tokens Get a refresh token with offline_access and use it to get a new access token.
  6. 6 OpenID Connect Get an ID token and read the user's identity out of it.
  7. 7 Protecting an API with OAuth Call your practice API with an access token, and watch it enforce the scopes you chose.
  8. 8 Token Introspection and Revocation Ask your server whether a token is active, revoke it, and see the API stop accepting it.

Coming soon

OAuth for Native Applications · OAuth for IoT and Smart Devices

About

This website is a companion to the course OAuth 2.0 Simplified and the live class Hands-on Introduction to OAuth 2.0 by Aaron Parecki.

The course videos were recorded using Auth0 as the authorization server. You no longer need an Auth0 account: wherever a video goes to the Auth0 dashboard, use your Developer Console here instead.