1 min lesson
OAuth 2.0 / OIDC fundamentals
Put this idea into your own words: "OIDC is a thin identity layer on top of OAuth that adds an ID token."
Step 1 of 2
The Cursor JD leads with authentication. An EM for Core Services is expected to reach for the right OAuth flow without thinking, then explain the trade-off out loud while a peer pokes holes in it.
Start by separating two specs that interviewers love to conflate. OAuth 2.0 is an authorization framework: it answers "can this client act on this resource on the user's behalf," and it hands back access tokens. OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition. is a thin identity layer on top of OAuth that adds an ID token - a signed JWT that says "this is who the user is." You ask OAuth for permission to call an API; you ask OIDC who just logged in.
Flow selection is a function of one question: can the client keep a secret? A backend service can. A desktop editor or a single-page app cannot, because anything shipped to a user's machine can be extracted.
Learn more
Advanced table
Pick by who holds the secret and whether a browser is present
- Client type
- Cursor desktop editor, web SPA
- Flow
- Authorization Code + PKCE
- Why
- Public client, no secret; PKCE binds the code to the requester so a stolen code is useless
- Client type
- Service-to-service (Core Services → internal API)
- Flow
- Client Credentials
- Why
- No human in the loop; the service authenticates as itself with a real secret
- Client type
- Headless / CLI / SSH box
- Flow
- Device Authorization
- Why
- No browser on the device; the user approves on a phone or laptop via a short code
- Client type
- Enterprise workforce login
- Flow
- OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition. / SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. to the customer IdP
- Why
- The org owns identity; Cursor federates rather than holding passwords
| Client type | Flow | Why |
|---|---|---|
| Cursor desktop editor, web SPA | Authorization Code + PKCE | Public client, no secret; PKCE binds the code to the requester so a stolen code is useless |
| Service-to-service (Core Services → internal API) | Client Credentials | No human in the loop; the service authenticates as itself with a real secret |
| Headless / CLI / SSH box | Device Authorization | No browser on the device; the user approves on a phone or laptop via a short code |
| Enterprise workforce login | OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition. / SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. to the customer IdP | The org owns identity; Cursor federates rather than holding passwords |
Pick by who holds the secret and whether a browser is present.