OAuth 2.0
Most important commands to remember
curl --fail --silent --show-error— retrieve server metadata and report HTTP errors.jq— select the protocol fields you want to inspect.
Commands and flags
| Command or option | Meaning |
|---|---|
curl --fail |
Return an error for HTTP responses of 400 or higher. |
--silent --show-error |
Hide the progress meter but retain error messages. |
--max-time 10 |
Limit the transfer to ten seconds. |
jq '{…}' |
Display an object containing the named JSON fields. |
| |
Send curl’s response body to jq. |
The URL is public discovery metadata. This request contains no credentials. A missing field appears as null; that does not by itself prove a feature is unsupported.
The concepts that matter
1. OAuth delegates access
Suppose a calendar application needs permission to read your calendar from another service. OAuth lets it obtain limited API access without receiving your account password.
The client requests access, the authorization server issues tokens, and the resource server hosts the protected API. A person may authorize delegated access as the resource owner. These roles can belong to different services even when one company operates them.
2. An authorization code is exchanged for tokens
In the authorization code flow, the browser visits the authorization server. After the required authentication and authorization decisions, the browser returns to a registered redirect URI with a short-lived code. The client exchanges that code at the token endpoint.
PKCE binds this exchange to a verifier held by the initiating client. An intercepted code alone is insufficient. Public clients cannot reliably keep a shared client secret; confidential clients may also authenticate themselves. Use a maintained protocol library for the complete flow.
3. Tokens have a purpose and a destination
An access token is presented to an API. Its intended audience, granted permissions, expiry, and other applicable checks constrain acceptance. A token issued for one API should not become universal permission to every API.
A refresh token, when issued, lets a client obtain new access tokens under the server’s policy. It belongs at the authorization server, not in ordinary API calls. Access tokens need not be JWTs: their representation is a separate choice.
4. Access is different from login
OAuth answers whether a client can access a resource under a grant. It does not, by itself, define a standard identity statement for signing a person into that client. OpenID Connect adds that authentication layer.
The distinction matters when building applications: successfully receiving an access token is not a reason to accept arbitrary token fields as a verified user identity. The API and the client have different validation responsibilities.
One small example
Optional: inspect Microsoft’s public discovery document. It advertises OAuth endpoints alongside OpenID Connect information. No account, app registration, or token is required.
curl --fail --silent --show-error --max-time 10 https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration | jq '{authorization_endpoint, token_endpoint, grant_types_supported, code_challenge_methods_supported}'Compare authorization_endpoint with token_endpoint: the first supports browser authorization, while the second handles token exchanges. Inspect the advertised grants and PKCE methods if present. Metadata describes capabilities; an individual registered client is not automatically allowed to use all of them.
The common endpoint is Microsoft’s multitenant entry point. This exercise does not select a tenant, register a redirect URI, run PKCE, or acquire a token. A successful JSON response proves only that you retrieved and inspected configuration.
Keep this idea: OAuth gives a client bounded access to an API; a token is useful only within the receiving service’s validation rules.