Securing Your APIs with OAuth 2.0 - API Days

[@Chris.Plunkett]

This is a golden example of how a technical presentation should be. Great job!

[@starman9000]

Presenter was clear in mind what he is talking! I am able to understand which I failed to uderstand from many other similar content. Thank you.

[@mingzus]

not shortest one in KZbin, but one of the BEST to explain Oauth ! Thanks you !

[@parthsalat]

That's coz he made Oauth 2.0

[@AnonyoX]

One of the best presentations on this topic. Lucid, on-point, and yet moderately detailed. Thank you, Aaron.

[@ThePersepolis32]

I already read some articles, but this was a perfect explanation.

[@joeyjoejoo]

that was an absolutely brilliant tutorial. thanks very much.

[@OktaDev]

You're very welcome! Glad that you enjoyed it.

[@FictionsAndIllusions]

Thanks for this video. I was curious about how to secure Web APIs using OAuth2.0 and the second half of this talk answered it perfectly.

[@sergiocamacho730]

Excellent presentation. It wasn't hard at all to watch for a half-hour talk.

[@randyhockin2437]

Excellent presentation Aaron.

[@pepsiholix]

Now that was an exzellent talk!

[@beatagozdziaszek8157]

6:28 Start of the OAuth 2.0 flow

[@bdoesbjj]

tintuu Why are you laughing? Your comment in not helpful at all.

[@santiagocavanna]

Thanks for sharing this information. I found it very clear and useful. I am doing some work as IAM Arch and not always it is clear the path.

[@JanithKalhara]

Simple and clean.

[@alirezaamedeo]

PKCE is not the replacement of client authentication. It's simply to prove whoever is exchanging code for token is the same guy who requested the code.

[@sumitkumarb4u]

Very nice presentation. Really helped!

[@DilSeSwiss]

comprehensive presentation, thanks

[@smritisharan-sfdcamplified]

Nice

[@green10701]

Perfect explanation 10:28

[@domaincontroller]

Specs are not good tutorials, 20 specs 00:57 the password anti-pattern 02:23 OAuth spec, Sign in with 02:46 OAuth was designed to give access to data, accessing APIs not about identifying the user 04:15 OpenID connect 04:36 OAuth originally created for that third-party app access, first party app as well, gmail actually redirects you to the google OAuth server 06:24 we gonna take a look how OAuth works, from an application point of view 06:39 access token, hotel key 07:57 five roles 08:51 starting with the simplest flow 10:45

[@mansimen]

Hi, great presentation, the hotel card analogy is quite good. But IMHO, really poor choice of colors for the slides. I'm colorblind and don't see any difference between those arrows that you mentioned in slide at minute 10:39.

[@alittleextra2832]

The world does not revolve around you.

[@alirezaamedeo]

You may not want to expose scopes of a JWT to the world so reference token will be the only option.

[@HenryPan]

Is OAuth 2.0 itself secure enough?

[@oko2708]

4:15

[@davidharris3391]

Empirical data, i.e. the past several years of billions (or trillions ?) of transactions using Oauth2 would say 'if used properly, yes'.

[@allyc0des972]

It's couldn't care less, not could care less