1 min lesson
Three token types, three jobs
Make the call on "Which token goes where - access, refresh, ID?" Name the clue that decides it.
Step 1 of 3
Three token types, three jobsknow where each is validated
- Access token
- Short-lived (minutes); sent to APIs; validated by the resource server against scopes
- Refresh token
- Long-lived; held carefully; traded for a new access token at the token endpoint
- ID token
- OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition. only; proves who logged in; validated by the client, never sent to APIs
Sending an ID token to an API or an access token to a client is a classic tell.
Learn more
Full explanation
The pattern you'll actually build
The pattern you'll actually buildautomating the SaaS stack
Most of your OAuth work as an IT engineer is service-to-service: a script that provisions a Slack user, pulls Okta logs or manages Google Workspace groups. That's client credentials (or a Google service account with domain-wide delegation), not interactive login.
Service account + domain-wide delegation.
Scope it to exactly the Admin SDK methods you call - directory read/write only.
Bot/app token with granular OAuth scopes.
Request users:read, not admin, unless you truly run SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition./admin actions.
API token or OAuth client-credentials app.
Prefer a scoped OAuth service app over a long-lived super-admin API token.
Learn more
Full explanation
Security gotchas to name unprompted
Security gotchas to name unprompted
- Exact-match redirect URIs. Wildcards turn PKCE into theater - the code gets delivered to the attacker's URL.
- Least-privilege scopes. A token that reads one group is a smaller breach than one that admins the tenant. Scope is your blast-radius dial.
- Secret rotation. Client secrets and API tokens live in a secrets manager, rotate on a schedule and never sit in a repo or a Slack message.
- Token storage. Refresh tokens are bearer credentials - anyone who has one is the user until it's revoked.
When asked to design an integration, lead with the secret question: "Is there a human and a browser or is this a backend service? If it's my automation calling the Okta API, that's client credentials with a scoped service app, not a personal admin token." That framing shows you reach for least privilege by reflex.
Don't conflate authentication and authorization. "Log the user in with OAuth" is the single most common giveaway that someone learned auth from copy-paste. Login is OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition.; OAuth grants API access.
Learn more
Optional practice
Practice: Three token types, three jobs
QYou're writing a Python script to deprovision users in Slack via its API. Which OAuth grant fits and what's the access principle?