Jean-François Lombardo

OAuth 2 in Action, Second Edition

OAuth 2 in Action, Second Edition is the definitive guide to OAuth, the protocol that secures APIs across the internet. Extensively revised for its second edition, this new version is fully up to date with the latest best practices, new grant types, modern client patterns, and the growing ecosystem of standards built on top of OAuth 2. You’ll learn to confidently and securely build and deploy OAuth for the client, the authorization server, and the protected resource.

You’ll start with a clear overview of OAuth’s actors, tokens, scopes, and flows, and then get hands-on by building each component from the ground up. From there, you’ll dig into common implementation vulnerabilities and how to defend against them, structured tokens and JWTs, dynamic client registration, and OpenID Connect for authentication. By the end, you’ll be equipped to make sound design decisions and deploy OAuth-based systems that hold up under real-world conditions.

The new edition captures the shifting landscape of OAuth, including PKCE and the new specifications that have emerged to address real-world deployment challenges. You’ll find substantial new content on OAuth 2.1, Pushed Authorization Requests, Rich Authorization Requests, and Token Exchange, as well as covering the device code grant, DPoP for proof-of-possession tokens, HTTP Message Signatures, and more. You’ll also explore the wider protocol ecosystem, from GNAP, FAPI and Open Banking, to SMART on FHIR in healthcare, and how OAuth intersects with newer patterns like the Model Context Protocol (MCP) and workload identity.

Clear code examples in Python, detailed system and flow diagrams, and practical exercises walk you through every concept. Whether you’re an application developer integrating with an API, an architect designing a secure system, or an engineer protecting a REST service, this book gives you the depth and perspective you need to work with OAuth 2.0 with confidence.