TodayTools

Login, OAuth and JWT flashcards

Passwords, sessions, passkeys, "Sign in with...", OAuth, OpenID Connect and JWTs: build login that is easy to use and hard to break.

Donate
Beginner friendly, starts from zero
Section
How to study
0
Login, OAuth and JWTStart from zero · 1 of 11

versus : what is the difference?

checks who you are, like showing your ID at the door. decides what you may do inside, like which rooms your badge opens.

AuthN: who are you? AuthZ: what can you do?
Show again
11 left
Got it

Tap to turn over. Swipe right if you know it, left to see it again.

All topics

What you will learn

  1. Start from zero

    • Who and what5 cards
    • Key words6 cards

  2. Core basics

    • Passwords and sessions5 cards
    • MFA and recovery4 cards
    • JWT basics7 cards

  3. Next steps

    • OAuth roles and flow4 cards
    • Tokens and scopes3 cards
    • OpenID Connect4 cards
    • Machines, devices and single page apps5 cards

  4. Go deeper

    • JWT attacks3 cards
    • Revocation and sender-constrained tokens4 cards
    • Standards today3 cards
    • Passkeys inside3 cards
    • Enterprise and authorisation3 cards

Final test and certificate

10 questions drawn fresh from the whole topic, about 15 minutes. Sign in, score 80% or more and get a free certificate with your name and a public check link anyone can open, such as an employer or a teacher. Not signed in? Try a practice test from the cards.

Take the final test

About these cards

  • Reviewed 26 October 2026
  • CoversOAuth 2.0 with RFC 9700OAuth 2.1 draft (2026)OpenID Connect Core 1.0WebAuthn Level 3NIST SP 800-63B-4
How these cards are made

Login, OAuth and JWT at a glance

Login is how an app knows who you are and what you may do, using passwords, codes, passkeys or a sign-in from another account.

Logging in is like checking in at a hotel. You prove who you are once at the desk, then get a key card that opens only your room and stops working when you check out.

Words you will meet

Authentication
Proving who you are, like showing an ID
Authorisation
Deciding what you are allowed to do once known
Session
The period you stay logged in, remembered by the server
Cookie
A small note the browser keeps and sends back to the same site
Token
A string that acts like a ticket: show it to get in
OAuth
A standard way to let one app use another app on your behalf without sharing your password
JWT
A signed token that carries facts like your user ID and when it expires
Passkey
A login stored on your phone or laptop, unlocked by fingerprint, face or PIN, with no password to type

The steps

  1. 1. Start from zero (11 cards): Who you are versus what you may do, keys and tickets, and the words every later card uses, explained with everyday examples.
  2. 2. Core basics (16 cards): Password storage, sessions and cookie flags, MFA, reset flows, and what is inside a JWT and how it is checked.
  3. 3. Next steps (16 cards): OAuth roles and the authorisation code flow with PKCE, scopes, refresh tokens, OpenID Connect, JWKS, machine logins and SPAs.
  4. 4. Go deeper (16 cards): JWT attacks, revocation trade-offs, sender-constrained tokens, OAuth 2.1 and the security best practice, passkeys inside, and enterprise SSO.
All 11 cards in Start from zero
Authentication versus authorisation: what is the difference?
Authentication checks who you are, like showing your ID at the door. Authorisation decides what you may do inside, like which rooms your badge opens.
Name the three kinds of proof a login can use.
Something you know (a password or PIN), something you have (your phone or a security key), and something you are (fingerprint or face). Using two kinds is multi-factor authentication.
Why is a password alone not enough today?
People reuse passwords, and leaked password lists are tried on other sites automatically. A second factor or a passkey stops a stolen password from being enough.
How does a site remember you are logged in?
After login, the server creates a session and gives your browser a cookie with a random session ID. The browser sends it with every request, so the server knows it is you.
What is a token, in everyday terms?
A token is a ticket. Whoever holds it can use it until it expires, like a cinema ticket. Apps send tokens to servers instead of sending your password each time.
What does "Sign in with Google" actually do?
The app sends you to Google to sign in. Google then tells the app who you are, without the app ever seeing your Google password. OAuth and OpenID Connect are the rules behind it.
What is OAuth, with an everyday picture?
OAuth is like a valet key for a car: it starts the car but cannot open the boot. You let a photo printing app read your photos without giving it your password or access to everything else.
What is a JWT?
A JWT (JSON Web Token, said "jot") is a ticket with facts written on it, like your user ID and expiry time, plus a signature so the server can tell if anyone changed it.
What is a passkey?
A passkey is a login saved on your phone or laptop and unlocked with your fingerprint, face or PIN. There is no password to type, guess or steal, and it only works on the real website.
Where do you meet these ideas in daily life?
Banking apps asking for a code (MFA), "Sign in with Google or Apple" buttons (OAuth and OpenID Connect), phones offering to save a passkey, and "you were logged out" after a while (session expiry).
What do you need before starting, and what can you do after?
Know what a website and an API are and have seen a little HTML. After this topic you can build safe login, read and check tokens, and add third-party sign-in correctly.
Login, OAuth and JWT cheatsheet

Cookies and sessions

  • Set-Cookie: sid=...; HttpOnly; Secure; SameSite=Lax; Max-Age=28800 Safe session cookie
  • __Host-sid Cookie prefix: Secure, no Domain, Path=/
  • Rotate session ID at login Stops session fixation
  • Delete server session at logout Real logout
  • CSRF token on state-changing forms Blocks forged requests

JWT claims

  • "iss" Who issued it
  • "sub" User or client ID
  • "aud" Which API it is for
  • "exp" / "iat" Expiry / issued at (seconds)
  • "scope" What the client may do
  • "kid" (header) Which key signed it

OAuth and OIDC

  • response_type=code + code_challenge (S256) Code flow with PKCE
  • grant_type=authorization_code Swap code for tokens
  • grant_type=refresh_token New access token
  • grant_type=client_credentials Machine to machine
  • scope=openid profile email Ask for login via OIDC
  • /.well-known/openid-configuration Discovery document

Verify checklist

  • algorithms=["RS256"] Fixed allow list
  • audience=... Token meant for this API
  • issuer=... From your provider
  • exp with small leeway Not expired
  • scope and ownership Allowed to do this, on this record

Passwords and MFA

  • Argon2id / bcrypt Password hashing
  • Min 15 chars if password only NIST SP 800-63B-4
  • Block breached passwords Check on set and change
  • Passkey / security key Phishing-resistant MFA
  • TOTP 30 s window Authenticator app codes
Donate