Diagrams
Seven flows, one step at a time.
Walk them. The samples on the right show the shape of a message. They aren’t credentials, and they won’t work if you paste them anywhere.
Authorization code + PKCE
OpenID Connect, on the only user-facing grant OAuth 2.1 still wants. Watch the code go out through the browser and the token come back between servers.
Walk it 02 · AuthenticatorPasskeys
Two ceremonies. Make a key that’s bound to the site, then sign a fresh challenge. The private key stays put.
Walk it 03 · WorkforceSAML 2.0
A signed statement, carried by the browser. Still the integration behind a lot of enterprise SaaS.
Walk it 04 · LifecycleSCIM
HR decides, the SCIM client pushes. The call that matters is the one that sets active to false.
Walk it 05 · DelegationAn agent acts for a person
The person signs in. The agent gets its own token, stuck to its key, with a separate actor claim.
Walk it 06 · MachinesA workload calls an API
Client credentials. The process signs in as itself and gets a short token for one API.
Walk it 07 · PrivilegeJust-in-time access
No standing right. A request, a yes or a no, a grant that already has an end, and a log.
Walk itWhat the channels mean
Front channel
The person’s browser carries the message. Redirects and form posts live here, and anything in a URL can end up in history, a log, or a Referer header. A code is tolerable there because it’s single-use and useless without the PKCE verifier. An access token is happier on the other channel.
Back channel
Two servers talk, or a server calls an API, and the browser isn’t the courier. Token endpoints, SCIM, and ordinary API calls live here. This is where the client should authenticate, and where proof-of-possession belongs.