5 min
Authorization Code and PKCE, by hand
Run the full browser flow with curl, inspect the tokens, rotate a refresh token, and watch PKCE reject a wrong verifier.
- oauth2
- pkce
pkce
2 posts.
6 min
The mental model
OAuth roles, the Authorization Code flow, PKCE, the three kinds of token, and JWT signing, before any code.
- oauth2
- oidc