Application & API Security
How applications request, present and validate tokens to reach APIs.
CIBA Backchannel Authentication
Approve a sign-in or transaction on a separate device.
OAuth Authorization Code
Classic three-party authorization code exchange.
OAuth Code + PKCE
Authorization code exchange hardened with PKCE.
OAuth Client Credentials
Get an access token for machine-to-machine API calls.
OAuth Device Authorization
Sign in on input-constrained devices using a second device.
OAuth Private Key JWT
Authenticate a client with a signed JWT, not a secret.
OAuth Refresh Token
Renew an expired access token without user interaction.