API Security

An authorization framework that enables third-party applications to obtain limited access to a web service on behalf of a resource owner, without exposing credentials.

OIDC

An identity layer built on top of OAuth 2.0 that allows clients to verify the identity of an end-user and obtain basic profile information using an ID Token.

JWT

A compact, URL-safe token format that encodes claims as a JSON object, digitally signed for integrity verification, commonly used to transmit authentication and authorization information between parties.

An authentication method where a server generates an encrypted token upon successful login that the client includes in subsequent requests, eliminating the need to send credentials with every request.

The process of securely handling user sessions after authentication, including session creation, tracking, timeout, invalidation, and protection against session hijacking and fixation attacks.

The practices, patterns, and technologies used to protect application programming interfaces from unauthorized access, data breaches, and abuse, including authentication, authorization, rate limiting, and input validation.

A mechanism in OAuth 2.0 that limits the access granted to a client application, defining specific permissions the client can request and the resource owner can approve.

An OAuth 2.0 grant type where the client receives an authorization code from the authorization server and exchanges it for access and refresh tokens via a back-channel request, providing the most secure flow for server-side applications.

PKCE

An extension to the OAuth 2.0 Authorization Code flow that protects against authorization code interception attacks by requiring the client to create a cryptographic code verifier and challenge.