Fourteen parts, from an empty Spring Boot project to a production-oriented OAuth 2.1-style and OpenID Connect authorization server: PKCE, JWT, refresh rotation, PostgreSQL, user and client administration, revocation, Docker and CI.https://blog.subashsdhami.com.np/enhttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/00-the-plan/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/00-the-plan/What we are building, what OAuth and OpenID Connect each answer, and what this series deliberately leaves out.Mon, 21 Sep 2026 00:00:00 GMToauth2oidcspring-boothttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/01-the-mental-model/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/01-the-mental-model/OAuth roles, the Authorization Code flow, PKCE, the three kinds of token, and JWT signing, before any code.Mon, 21 Sep 2026 00:00:00 GMToauth2oidcpkcejwthttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/02-a-server-that-starts/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/02-a-server-that-starts/Spring Authorization Server on port 9000 with OIDC, a development client and user, token policy, and discovery and JWKS endpoints.Mon, 21 Sep 2026 00:00:00 GMTspring-bootspring-securityoauth2oidchttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/03-authorization-code-and-pkce-by-hand/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/03-authorization-code-and-pkce-by-hand/Run the full browser flow with curl, inspect the tokens, rotate a refresh token, and watch PKCE reject a wrong verifier.Mon, 21 Sep 2026 00:00:00 GMToauth2pkcejwthttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/04-state-that-survives-a-restart/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/04-state-that-survives-a-restart/Move registered clients, authorizations and consent into PostgreSQL, with Flyway owning the schema.Mon, 21 Sep 2026 00:00:00 GMTpostgresqlflywayspring-boothttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/05-users-in-the-database/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/05-users-in-the-database/Replace the in-memory user with JPA entities, roles, and a database-backed UserDetailsService that accepts username or email.Mon, 21 Sep 2026 00:00:00 GMTspring-securityjpapostgresqlhttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/06-registration-errors-and-dev-data/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/06-registration-errors-and-dev-data/A registration API with validation, one consistent error format, and demo credentials that only exist in the dev profile.Mon, 21 Sep 2026 00:00:00 GMTspring-bootvalidationapi-designhttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/07-managing-clients-and-scopes/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/07-managing-clients-and-scopes/ADMIN-only APIs for OAuth clients and a scope registry, with roles carried in the access token.Mon, 21 Sep 2026 00:00:00 GMTspring-securityoauth2api-designhttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/08-real-tests-and-stable-keys/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/08-real-tests-and-stable-keys/Integration tests against real PostgreSQL with Testcontainers, and RSA signing keys that survive a restart.Mon, 21 Sep 2026 00:00:00 GMTtestingtestcontainersjwthttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/09-accounts-passwords-and-lockout/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/09-accounts-passwords-and-lockout/User administration, self-service and admin password changes, and a temporary lockout after repeated failed logins.Mon, 21 Sep 2026 00:00:00 GMTspring-securitysecurityapi-designhttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/10-id-tokens-and-userinfo/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/10-id-tokens-and-userinfo/Scope-aware identity claims in the ID token and the UserInfo endpoint, and a real OIDC flow to prove them.Mon, 21 Sep 2026 00:00:00 GMToidcjwtspring-securityhttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/11-revoking-a-jwt/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/11-revoking-a-jwt/Token revocation and introspection, and a filter that makes the management APIs reject a revoked JWT immediately.Mon, 21 Sep 2026 00:00:00 GMToauth2jwtsecurityhttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/12-hardening-for-production/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/12-hardening-for-production/Externalised issuer and CORS, health probes, and a persistent security audit trail.Mon, 21 Sep 2026 00:00:00 GMTsecurityspring-bootdevopshttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/13-docker-ci-and-v1/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/13-docker-ci-and-v1/A non-root container image, keys mounted at runtime, CI against real PostgreSQL, and a clean v1.0.0 release.Mon, 21 Sep 2026 00:00:00 GMTdockercidevopshttps://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/14-references/https://blog.subashsdhami.com.np/series/build-oauth2-authorization-server/14-references/Every specification and document the series relies on, grouped by subject.Mon, 21 Sep 2026 00:00:00 GMToauth2oidcreferences