OAuth 2.0 and OpenID Connect (in plain English)
Why Hacker News recommends it
HN repeatedly points people to it as the clearest way to finally understand OAuth, to the point that one team made it required viewing for new hires.
What it is
Okta developer advocate Nate Barbettini explains OAuth 2.0 and OpenID Connect in a roughly hour-long talk. It starts from the problems the protocols solve and walks through the flows. The description notes the implicit flow material is now out of date.
Recommended by 7 HN commenters across 6 different months, 2019 to 2026.
What Hacker News said
Strong rec sakisv · 2020-07 · on “Everything you need to know about OAuth 2.0”
This also has a very nice and simple explanation of the whole thing: [this video] It's about 1h long, but it's really worth it.
Strong rec butisaidsudo · 2023-04 · on “Why is OAuth still hard in 2023?”
I read so many docs when I was trying to implement OAuth and got more and more confused. This video was a huge help though for explaining all of the concepts: [this video]
Strong rec willsmith72 · 2024-04 · on “Learn OAuth by building a client with Node.js”
at my old company we worked with auth a lot, so it was a requirement for new joiners to watch this in their first week. i still recommend it if you want to learn oauth from 0 [this video]
Recommends manigandham · 2019-10 · on “An Illustrated Guide to OAuth and OpenID Connect”
Seems there's still confusion so I'll copy/paste my old comment: OAuth 1.0/2.0 are a set of protocols and standards allowing applications to identify users and get access to their data using existing profiles. OAuth is mostly focused around authorization with claims (which are just key-value pairs) and authentication was an afterthought. OpenID is another standard designed to let people authenticate across the web, launched with a lot of hype in the early web 2.0 days but never took off. OpenID Connect (OIDC) is a new standard based on OAuth 2 + OpenID to provide both authentication and authorization in a single flow. OIDC/OAuth is all based on tokens, which are JWTs containing a bunch of cl
Recommends krantic · 2023-11 · on “Ask HN: Any comprehensive courses on Auth?”
I have not seen a course that covers all of the things you are asking for. The best courses on the oidc/oauth and saml I have seen were the paid ones here: [LINK] On linkedinlearning this one was quite ok: [LINK] Free ressources check: - [LINK] -OAuth 2.0 and OpenID Connect (in plain English): [this video] [LINK] -OAuth/OpenID by Nat Sakimura(chairman openid foundation) [LINK] For the active directory topic I don't know good ressources
Recommends langur · 2023-11 · on “Ask HN: Any comprehensive courses on Auth?”
I found Nate Barbettini's video on OAuth and OpenID Connect incredibly insightful for understanding these topics. He explains everything so well- [this video] . Additionally, I'm part of the ZITADEL team, an open-source project that's free to download or use in our cloud offering. So, you can always tinker around with it as some others have already suggested. Our blog dives into various security topics, ranging from OAuth, OpenID Connect, and Single Sign-On, Authentication, Federation to emerging issues like Passkeys. We also discuss real-world Identity Management problems and solutions seen by ZITADEL users— [LINK] . For any specific security-related queries, feel free to join the conversation o
Recommends scandox · 2026-02 · on “What Is OAuth?”
[this video] A classic explainer from almost a decade ago. This explains it from the point of view of the original problem it was designed to solve.