DEVELOPER

OAuth 2.1 / OIDC Client

Use Authorization Code + PKCE for user-facing clients, confidential credentials only where a protected backend exists, narrow scopes and controlled token lifecycle.

01 / CONCEPT

Integration contract

Client types

Public clients cannot safely hold a secret; confidential clients protect credentials in a backend or workload boundary.

Authorization flow

Authorization Code + PKCE with state; OIDC clients validate issuer, audience and nonce where applicable.

Token lifecycle

Keep access tokens short-lived, protect refresh tokens, revoke on compromise and never log bearer tokens.

Redirect URI

Match registered redirect URIs exactly in production; avoid open redirects and wildcard hosts.

02 / WORKFLOW

From sandbox to evidence

01Build authorization request with PKCE
02Authenticate user and evaluate consent/policy
03Exchange code at token endpoint
04Call API with approved scope
05Refresh only within policy
06Revoke/logout and clear local session
07Handle invalid_grant / insufficient_scope deterministically

03 / SECURITY & PRODUCTION

Production is an evidence decision

OAuth safety depends on the registered client type, exact redirects, PKCE/nonce handling, token storage, revocation and scope policy for the deployed application.