Skip to lesson
Exit
Identity & Access Deep Dive1 / 3

1 min lesson

Three token types, three jobs

Make the call on "Which token goes where - access, refresh, ID?" Name the clue that decides it.

Step 1 of 3

Three token types, three jobsknow where each is validated

Tokens
Access token
Short-lived (minutes); sent to APIs; validated by the resource server against scopes
Refresh token
Long-lived; held carefully; traded for a new access token at the token endpoint
ID token
OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition. only; proves who logged in; validated by the client, never sent to APIs

Sending an ID token to an API or an access token to a client is a classic tell.

Learn more

Full explanation

The pattern you'll actually build

The pattern you'll actually buildautomating the SaaS stack

Most of your OAuth work as an IT engineer is service-to-service: a script that provisions a Slack user, pulls Okta logs or manages Google Workspace groups. That's client credentials (or a Google service account with domain-wide delegation), not interactive login.

Google Workspace

Service account + domain-wide delegation.

Scope it to exactly the Admin SDK methods you call - directory read/write only.

Slack

Bot/app token with granular OAuth scopes.

Request users:read, not admin, unless you truly run SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition./admin actions.

Okta

API token or OAuth client-credentials app.

Prefer a scoped OAuth service app over a long-lived super-admin API token.

Learn more

Full explanation

Security gotchas to name unprompted

Security gotchas to name unprompted

  • Exact-match redirect URIs. Wildcards turn PKCE into theater - the code gets delivered to the attacker's URL.
  • Least-privilege scopes. A token that reads one group is a smaller breach than one that admins the tenant. Scope is your blast-radius dial.
  • Secret rotation. Client secrets and API tokens live in a secrets manager, rotate on a schedule and never sit in a repo or a Slack message.
  • Token storage. Refresh tokens are bearer credentials - anyone who has one is the user until it's revoked.
Interview move

When asked to design an integration, lead with the secret question: "Is there a human and a browser or is this a backend service? If it's my automation calling the Okta API, that's client credentials with a scoped service app, not a personal admin token." That framing shows you reach for least privilege by reflex.

Watch out

Don't conflate authentication and authorization. "Log the user in with OAuth" is the single most common giveaway that someone learned auth from copy-paste. Login is OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition.; OAuth grants API access.

Learn more

Optional practice

Practice: Three token types, three jobs

QYou're writing a Python script to deprovision users in Slack via its API. Which OAuth grant fits and what's the access principle?