OAuth and OpenID Connect, by ear
15 episodes, in order, 5 checked against the publisher's transcript. Delegated authorization and federated sign-in, from first principles to the current security best practice. Start at the top if the topic is new to you, or jump to the stage that matches where you are.
Start here: the basics
- 1Open Authorization In The World Of AI With Aaron PareckiThe Secure Developer · 2025-06-10 · 36 min · Learner
How OAuth evolved from 1.0 to 2.1 for delegated access, how OpenID Connect and DPoP extend it, and how OAuth applies to authorizing AI agents and MCP servers.
Checked against the publisher's transcript - 2OAuth 2.0 from Protecting APIs to Supporting Authorization & Authentication - Aaron Parecki - ASW #289Application Security Weekly · 2024-06-25 · 61 min · Learner
Why OAuth 2.0 is a family of specifications rather than one spec, and why it can be hard to secure by default and to make interoperable.
- 3SE Radio 376: Justin Richer On API Security with OAuth 2Software Engineering Radio · 2019-08-13 · 74 min · Learner
The core technical features of OAuth 2.0, including token types, OpenID Connect, PKCE, JWTs, client secrets, and patterns for single-page and mobile apps.
In practice: rollouts and operations
- 4OAuth, "It's complicated." (Changelog Interviews #456)The Changelog · 2021-08-23 · 70 min · Practitioner
Where OAuth 2.0 gets complicated, how PKCE and browser-based app guidance address it, and what OAuth 2.1 and GNAP change.
Checked against the publisher's transcript - 5OpenID Connect with Mike JonesIdentity, Unlocked · 2021-12-20 · 43 min · Practitioner
The design and history of OpenID Connect from one of its specification editors, covering protocol design, developer concerns, and legal aspects.
- 6#237 - OAuth 2.0 Step Up Authentication Challenge Protocol with Vittorio BertocciIdentity at the Center · 2023-10-09 · 36 min · Practitioner
What the OAuth 2.0 Step Up Authentication Challenge Protocol (RFC 9470) does, from its co-author.
- 7What's new with OAuth2.1 with Aaron PareckiIdentity, Unlocked · 2020-09-27 · 39 min · Practitioner
Explains how OAuth 2.1 consolidates OAuth 2.0 and its later RFCs, such as PKCE and the security BCP, into one document reflecting current best practice.
Going deeper: standards, architecture, and attacks
- 8SE Radio 526: Brian Campbell on Proof of Possession DefensesSoftware Engineering Radio · 2022-08-24 · 54 min · Architect
How proof-of-possession defends against stolen OAuth tokens, comparing OAuth mTLS and DPoP and their security versus complexity trade-offs.
Checked against the publisher's transcript - 9Nat Sakimura delves into Financial-Grade API (FAPI)Let's Talk About Digital Identity · 2022-01-12 · Architect
Why FAPI was created, its two core traits of integrity-protected messages and sender-constrained tokens, and where open banking uses it.
Checked against the publisher's transcript - 10#222 - Identity Standards with Justin Richer of Bespoke EngineeringIdentity at the Center · 2023-07-17 · 90 min · Architect
How OpenID Connect might be designed differently today and what the Grant Negotiation and Authorization Protocol (GNAP) aims to change.
- 11Delegation in a Multi-Actor World: It's Not Just OAuth AnymoreA Digital Identity Digest · 2025-06-27 · 12 min · Architect
Where OAuth 2.0 falls short for multi-party delegation and what OAuth Token Exchange (RFC 8693) does and does not provide.
Checked against the publisher's transcript - 12#422 - Decoded - Securing AI Agents with Standards You Already HaveIdentity at the Center · 2026-05-15 · 78 min · Architect
How existing OAuth specifications such as JWT authorization grant, token exchange, and client ID metadata, plus SPIFFE, apply to securing AI agents as workloads.
Pieter Kasselman (Defakto)agentic identity - 13#449 - Decoded - Transaction Tokens with George FletcherIdentity at the Center · 2026-09-21 · 71 min · Architect
How OAuth Transaction Tokens secure requests across microservices, including their claims, time to live, immutability, and use with AI agents.
- 14A Lap Around the OAuth2 Security BCP with Daniel FettIdentity, Unlocked · 2020-10-24 · 34 min · Architect
Walks through the OAuth 2.0 Security BCP and its three biggest recommendations: drop the implicit grant, use PKCE with the code flow, and sender-constrain tokens.
- 15PAR, RAR, and JAR with Filip SkokanIdentity, Unlocked · 2021-02-08 · 21 min · Architect
Explains three OAuth extensions, Rich Authorization Requests, Pushed Authorization Requests, and JWT-Secured Authorization Requests, and which core OAuth 2.0 shortcomings each one addresses.
How this list was built
Episodes are chosen for what they teach, not for who published them, and ordered so each one builds on the last. Each note is checked against the transcript the show publishes on its own site where one exists (marked and linked under the episode), and against the show notes otherwise. We link to episodes; we do not copy, host, or transcribe them. Vendor-produced shows are labelled on their directory profiles. Know a better episode for a step on this path? Email community@startwithidentity.com.