Justin Richer

JUSTIN RICHER is a systems architect, software engineer, standards editor, and service designer with over seventeen years of industry experience in a wide variety of domains including internet security, identity, collaboration, usability, and serious games. As an active member of the Internet Engineering Task Force (IETF) and OpenID Foundation (OIDF) he has directly contributed to a number of foundational security protocols including OAuth 2.0 and OpenID Connect 1.0, as well as being the editor of several extensions of OAuth 2.0 including Dynamic Client Registration (RFC7591 & RFC7592) and Token Introspection (RFC7662). His pioneering work with Vectors of Trust and the third edition of NIST’s Digital Identity Guidelines (Special Publication 800-63) have pushed the conversation of what a trusted identity means in an unpredictable landscape. He is the founder and maintainer of the enterprise-focused MITREid Connect open source implementation of OAuth 2.0 and OpenID Connect and has led production deployment of the system at a number of organizations including The MITRE Corporation and the Massachusetts Institute of Technology. An accomplished and confident presenter, he is much sought-after as a plenary and keynote speaker at conferences around the world to audiences of all technical proficiencies. An ardent proponent of open standards and open source, he believes in solving hard problems with the right solution, even if that solution still needs to be invented.

books by Justin Richer

OAuth 2 in Action, Second Edition
  • MEAP began October 2026
  • Last updated October 2026
  • Publication in Spring 2027 (estimated)
  • ISBN 9781633433083
  • 375 pages (estimated)

OAuth 2 in Action, Second Edition is the definitive guide to OAuth, the protocol that secures APIs across the internet. Extensively revised for its second edition, this new version is fully up to date with the latest best practices, new grant types, modern client patterns, and the growing ecosystem of standards built on top of OAuth 2. You’ll learn to confidently and securely build and deploy OAuth for the client, the authorization server, and the protected resource.

You’ll start with a clear overview of OAuth’s actors, tokens, scopes, and flows, and then get hands-on by building each component from the ground up. From there, you’ll dig into common implementation vulnerabilities and how to defend against them, structured tokens and JWTs, dynamic client registration, and OpenID Connect for authentication. By the end, you’ll be equipped to make sound design decisions and deploy OAuth-based systems that hold up under real-world conditions.

The new edition captures the shifting landscape of OAuth, including PKCE and the new specifications that have emerged to address real-world deployment challenges. You’ll find substantial new content on OAuth 2.1, Pushed Authorization Requests, Rich Authorization Requests, and Token Exchange, as well as covering the device code grant, DPoP for proof-of-possession tokens, HTTP Message Signatures, and more. You’ll also explore the wider protocol ecosystem, from GNAP, FAPI and Open Banking, to SMART on FHIR in healthcare, and how OAuth intersects with newer patterns like the Model Context Protocol (MCP) and workload identity.

Clear code examples in Python, detailed system and flow diagrams, and practical exercises walk you through every concept. Whether you’re an application developer integrating with an API, an architect designing a secure system, or an engineer protecting a REST service, this book gives you the depth and perspective you need to work with OAuth 2.0 with confidence.

Understanding API Security
  • February 2017
  • ISBN 9781617294327
  • 205 pages
Included with a Manning Online subscription
resources: OAuth 2 in Action Irresistible APIs SPA Design and Architecture Building the Web of Things Amazon Web Services in Action SOA Security

Gone are the days when it was acceptable for a piece of software to live in its own little silo, disconnected from the outside world. Today, services are expected to be available for programming, mixing, and building into new applications. The web-based Application Programming Interface, or API, is how services make themselves available in this dynamic world. By exposing an API, a service can find new life and utility far beyond what its core functionality was designed to be. But these APIs need to be secured and protected in order to be truly useful. An API that's simply left open to everyone, with no security controls, cannot be used to protect personalized or sensitive information, which severely limits its usefulness.

The OAuth delegation and authorization protocol is one of the most popular standards for API security today. Understanding API Security is a selection of chapters from several Manning books that give you some context for how API security works in the real world by showing how APIs are put together and how the OAuth protocol can be used to protect them.