How APIs Use OAuth 2.0 for Secure Authorization
from The API Podcast with Fexingo: REST, GraphQL, and Modern Web APIs Hosted by Fexingo
Most API developers know OAuth 2.0 is the standard for authorization, but implementing it securely is where the real challenge lies. In this episode, Lucas and Luna break down the authorization code flow with PKCE, explain why the implicit grant is on its way out, and walk through the security gotchas that still trip up teams in 2026. They use GitHub's OAuth implementation as a concrete example, discuss refresh token rotation, and question whether your API should even issue long-lived tokens. If you're building or consuming modern web APIs, this is the primer on OAuth that goes beyond the spec. #OAuth20 #PKCE #APISecurity #Authorization #WebAPIs #Technology #FexingoBusiness #BusinessPodcast #APIDevelopment #RESTAPI #GraphQL #RefreshTokens #ImplicitGrant #AccessTokens #GitHubAPI #TokenRotation #SecureCoding #DevOps Keep every episode free: buymeacoffee.com/fexingo
Embed this episode
No transcript yet.