API Authentication

1---
2name: api-authentication
3description: API authentication patterns including JWT, OAuth 2.0, API keys, and session-based auth. Covers token generation, validation, refresh strategies, security best practices, and when to use each pattern. Use when implementing API authentication, choosing auth strategy, securing endpoints, or debugging auth issues. Prevents common vulnerabilities like token theft, replay attacks, and insecure storage.
4---
5 
6# API Authentication Patterns
7 
8Comprehensive guide to implementing secure API authentication including JWT, OAuth 2.0, API keys, and session-based patterns. Covers when to use each approach, security best practices, and common vulnerabilities to avoid.
9 
10---
11 
12## Quick Reference
13 
14**When to use this skill:**
15- Implementing API authentication
16- Choosing between auth strategies (JWT vs OAuth vs sessions)
17- Securing API endpoints
18- Implementing token refresh logic
19- Debugging authentication issues
20- Preventing auth vulnerabilities
21 
22**Common triggers:**
23- "How should I implement authentication"
24- "JWT vs OAuth vs API keys"
25- "How to secure this API"
26- "Implement refresh tokens"
27- "Store authentication tokens securely"
28- "Fix authentication vulnerability"
29 
30**Prevents vulnerabilities:**
31- Token theft and replay attacks
32- Insecure token storage
33- Missing token expiration
34- Weak password hashing
35- CSRF attacks
36 
37---
38 
39## Part 1: Authentication Strategy Decision Matrix
40 
41### When to Use Each Pattern
42 
43| Pattern | Best For | Pros | Cons |
44|---------|----------|------|------|
45| **JWT** | Stateless APIs, microservices, mobile apps | Stateless, scalable, works across domains | Tokens can't be revoked easily, larger payload |
46| **OAuth 2.0** | Third-party access, social login, delegation | Industry standard, fine-grained permissions | Complex to implement, requires authorization server |
47| **API Keys** | Server-to-server, public APIs, rate limiting | Simple, great for service accounts | Not for users, can't be scoped easily |
48| **Sessions** | Traditional web apps, SSR, same-domain | Revocable, server-controlled, secure | Requires server state, doesn't scale horizontally easily |
49 
50### Decision Tree
51 
52```
53START: What type of client?
54 
55├─ Mobile app or SPA?
56│  └─ Use JWT (stateless, works across domains)
57│
58├─ Third-party integration?
59│  └─ Use OAuth 2.0 (delegation, scoped permissions)
60│
61├─ Service-to-service?
62│  └─ Use API Keys (simple, rate-limitable)
63│
64└─ Traditional web app (same domain)?
65   └─ Use Sessions (revocable, server-controlled)
66```
67 
68---
69 
70## Part 2: JWT (JSON Web Tokens)
71 
72### JWT Structure
73 
74```
75eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
76 
77[HEADER].[PAYLOAD].[SIGNATURE]
78```
79 
80**Header** (algorithm and type):
81```json
82{
83  "alg": "HS256",
84  "typ": "JWT"
85}
86```
87 
88**Payload** (claims):
89```json
90{
91  "sub": "1234567890",    // Subject (user ID)
92  "name": "John Doe",     // Custom claim
93  "iat": 1516239022,      // Issued at
94  "exp": 1516242622       // Expires at (required!)
95}
96```
97 
98**Signature** (verification):
99```
100HMACSHA256(
101  base64UrlEncode(header) + "." + base64UrlEncode(payload),
102  secret
103)
104```
105 
106### JWT Implementation (Python)
107 
108```python
109import jwt
110import datetime
111from fastapi import HTTPException, Security
112from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
113 
114SECRET_KEY = "your-256-bit-secret"  # Must be strong, from environment
115ALGORITHM = "HS256"
116ACCESS_TOKEN_EXPIRE_MINUTES = 15
117REFRESH_TOKEN_EXPIRE_DAYS = 7
118 
119security = HTTPBearer()
120 
121def create_access_token(user_id: int) -> str:
122    """Create short-lived access token."""
123    expires = datetime.datetime.utcnow() + datetime.timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
124    payload = {
125        "sub": str(user_id),
126        "exp": expires,
127        "iat": datetime.datetime.utcnow(),
128        "type": "access"
129    }
130    return jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)
131 
132def create_refresh_token(user_id: int) -> str:
133    """Create long-lived refresh token."""
134    expires = datetime.datetime.utcnow() + datetime.timedelta(days=REFRESH_TOKEN_EXPIRE_DAYS)
135    payload = {
136        "sub": str(user_id),
137        "exp": expires,
138        "iat": datetime.datetime.utcnow(),
139        "type": "refresh"
140    }
141    return jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)
142 
143def verify_token(credentials: HTTPAuthorizationCredentials = Security(security)) -> dict:
144    """Verify and decode JWT token."""
145    token = credentials.credentials
146    try:
147        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
148        if payload.get("type") != "access":
149            raise HTTPException(status_code=401, detail="Invalid token type")
150        return payload
151    except jwt.ExpiredSignatureError:
152        raise HTTPException(status_code=401, detail="Token expired")
153    except jwt.InvalidTokenError:
154        raise HTTPException(status_code=401, detail="Invalid token")
155 
156# Login endpoint
157@app.post("/login")
158async def login(username: str, password: str):
159    user = authenticate_user(username, password)  # Your auth logic
160    if not user:
161        raise HTTPException(status_code=401, detail="Invalid credentials")
162 
163    access_token = create_access_token(user.id)
164    refresh_token = create_refresh_token(user.id)
165 
166    return {
167        "access_token": access_token,
168        "refresh_token": refresh_token,
169        "token_type": "bearer"
170    }
171 
172# Protected endpoint
173@app.get("/protected")
174async def protected_route(payload: dict = Depends(verify_token)):
175    user_id = payload["sub"]
176    return {"message": f"Hello user {user_id}"}
177 
178# Refresh token endpoint
179@app.post("/refresh")
180async def refresh(refresh_token: str):
181    try:
182        payload = jwt.decode(refresh_token, SECRET_KEY, algorithms=[ALGORITHM])
183        if payload.get("type") != "refresh":
184            raise HTTPException(status_code=401, detail="Invalid token type")
185 
186        # Generate new access token
187        user_id = int(payload["sub"])
188        new_access_token = create_access_token(user_id)
189 
190        return {"access_token": new_access_token, "token_type": "bearer"}
191    except jwt.ExpiredSignatureError:
192        raise HTTPException(status_code=401, detail="Refresh token expired")
193    except jwt.InvalidTokenError:
194        raise HTTPException(status_code=401, detail="Invalid refresh token")
195```
196 
197### JWT Security Best Practices
198 
199**✅ Do:**
200- Use strong secret keys (256-bit minimum)
201- Always set expiration (`exp` claim)
202- Use short-lived access tokens (15 minutes)
203- Use separate refresh tokens (7 days)
204- Store secret in environment variables
205- Use HTTPS only
206- Validate signature on every request
207- Check token type (`access` vs `refresh`)
208 
209**❌ Don't:**
210- Store sensitive data in payload (it's base64, not encrypted!)
211- Use symmetric signing (HS256) for public APIs (use RS256)
212- Store tokens in localStorage (XSS vulnerability)
213- Skip expiration validation
214- Use same token for access and refresh
215- Hard-code secrets
216 
217### Token Storage (Client-Side)
218 
219**❌ Bad** (localStorage - vulnerable to XSS):
220```javascript
221localStorage.setItem('token', token);  // XSS can steal this!
222```
223 
224**✅ Good** (httpOnly cookie):
225```python
226# Server sets httpOnly cookie
227response.set_cookie(
228    key="access_token",
229    value=access_token,
230    httponly=True,  # Not accessible via JavaScript
231    secure=True,    # HTTPS only
232    samesite="lax", # CSRF protection
233    max_age=900     # 15 minutes
234)
235```
236 
237**✅ Also Good** (memory only for SPAs):
238```javascript
239// Store in memory (lost on refresh, but more secure)
240let accessToken = null;
241 
242async function login(username, password) {
243  const response = await fetch('/login', {
244    method: 'POST',
245    body: JSON.stringify({ username, password })
246  });
247  const data = await response.json();
248  accessToken = data.access_token;  // Store in memory
249}
250```
251 
252---
253 
254## Part 3: OAuth 2.0
255 
256### OAuth 2.0 Flows
257 
258**Authorization Code Flow** (most common, for web apps):
259```
2601. Client → Authorization Server: "User wants to log in"
2612. Authorization Server → User: Login page
2623. User → Authorization Server: Credentials
2634. Authorization Server → Client: Authorization code
2645. Client → Authorization Server: Exchange code for access token
2656. Authorization Server → Client: Access token + refresh token
266```
267 
268**Client Credentials Flow** (for service-to-service):
269```
2701. Service → Authorization Server: Client ID + Secret
2712. Authorization Server → Service: Access token
272```
273 
274### OAuth 2.0 Implementation (Authorization Code Flow)
275 
276```python
277from fastapi import FastAPI, HTTPException
278from authlib.integrations.starlette_client import OAuth
279import os
280 
281app = FastAPI()
282 
283oauth = OAuth()
284oauth.register(
285    name='google',
286    client_id=os.getenv('GOOGLE_CLIENT_ID'),
287    client_secret=os.getenv('GOOGLE_CLIENT_SECRET'),
288    server_metadata_url='https://accounts.google.com/.well-known/openid-configuration',
289    client_kwargs={'scope': 'openid email profile'}
290)
291 
292@app.get('/login/google')
293async def login_google(request: Request):
294    redirect_uri = request.url_for('auth_google')
295    return await oauth.google.authorize_redirect(request, redirect_uri)
296 
297@app.get('/auth/google')
298async def auth_google(request: Request):
299    try:
300        token = await oauth.google.authorize_access_token(request)
301        user_info = token.get('userinfo')
302 
303        # Create or update user in your database
304        user = get_or_create_user(
305            email=user_info['email'],
306            name=user_info['name']
307        )
308 
309        # Create your own JWT for subsequent requests
310        access_token = create_access_token(user.id)
311 
312        return {"access_token": access_token, "token_type": "bearer"}
313    except Exception as e:
314        raise HTTPException(status_code=400, detail=str(e))
315```
316 
317### OAuth 2.0 Scopes
318 
319```python
320# Define scopes for your API
321SCOPES = {
322    "read:posts": "Read posts",
323    "write:posts": "Create and edit posts",
324    "delete:posts": "Delete posts",
325    "read:profile": "Read user profile",
326    "write:profile": "Update user profile"
327}
328 
329# Include scopes in JWT
330def create_access_token(user_id: int, scopes: list[str]) -> str:
331    payload = {
332        "sub": str(user_id),
333        "exp": datetime.datetime.utcnow() + datetime.timedelta(minutes=15),
334        "scopes": scopes  # Add scopes to token
335    }
336    return jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)
337 
338# Check scopes in protected endpoint
339def require_scopes(required_scopes: list[str]):
340    def decorator(func):
341        async def wrapper(payload: dict = Depends(verify_token)):
342            token_scopes = payload.get("scopes", [])
343            if not all(scope in token_scopes for scope in required_scopes):
344                raise HTTPException(status_code=403, detail="Insufficient permissions")
345            return await func(payload)
346        return wrapper
347    return decorator
348 
349@app.delete("/posts/{post_id}")
350@require_scopes(["delete:posts"])
351async def delete_post(post_id: int, payload: dict = Depends(verify_token)):
352    # User has delete:posts scope
353    pass
354```
355 
356---
357 
358## Part 4: API Keys
359 
360### API Key Implementation
361 
362```python
363import secrets
364import hashlib
365from datetime import datetime
366 
367# Generate API key
368def generate_api_key() -> tuple[str, str]:
369    """Generate API key and return (key, hashed_key)."""
370    # Generate random 32-byte key
371    api_key = secrets.token_urlsafe(32)
372 
373    # Hash for storage (never store plain key!)
374    hashed_key = hashlib.sha256(api_key.encode()).hexdigest()
375 
376    return api_key, hashed_key
377 
378# Store in database
379def create_api_key(user_id: int, name: str) -> str:
380    api_key, hashed_key = generate_api_key()
381 
382    db.execute("""
383        INSERT INTO api_keys (user_id, name, key_hash, created_at)
384        VALUES (?, ?, ?, ?)
385    """, user_id, name, hashed_key, datetime.utcnow())
386 
387    # Return plain key to user (only time they see it!)
388    return api_key
389 
390# Verify API key
391def verify_api_key(api_key: str) -> dict:
392    """Verify API key and return user info."""
393    hashed_key = hashlib.sha256(api_key.encode()).hexdigest()
394 
395    result = db.execute("""
396        SELECT user_id, name, created_at, last_used_at
397        FROM api_keys
398        WHERE key_hash = ? AND revoked_at IS NULL
399    """, hashed_key).fetchone()
400 
401    if not result:
402        raise HTTPException(status_code=401, detail="Invalid API key")
403 
404    # Update last used timestamp
405    db.execute("""
406        UPDATE api_keys
407        SET last_used_at = ?
408        WHERE key_hash = ?
409    """, datetime.utcnow(), hashed_key)
410 
411    return {"user_id": result[0], "key_name": result[1]}
412 
413# Middleware
414from fastapi.security import APIKeyHeader
415 
416api_key_header = APIKeyHeader(name="X-API-Key")
417 
418@app.get("/api/data")
419async def get_data(api_key: str = Security(api_key_header)):
420    user_info = verify_api_key(api_key)
421    return {"data": "protected data", "user_id": user_info["user_id"]}
422```
423 
424### API Key Best Practices
425 
426**✅ Do:**
427- Hash keys before storing (use SHA-256 minimum)
428- Generate cryptographically secure keys (`secrets` module)
429- Allow users to name keys ("Production Server", "CI/CD")
430- Track last used timestamp
431- Allow key revocation
432- Rate limit by API key
433- Log API key usage
434 
435**❌ Don't:**
436- Store plain text keys
437- Use predictable key generation
438- Expose keys in URLs (use headers)
439- Share keys across environments
440 
441### API Key Revocation
442 
443```python
444@app.delete("/api-keys/{key_id}")
445async def revoke_api_key(key_id: int, current_user: dict = Depends(get_current_user)):
446    db.execute("""
447        UPDATE api_keys
448        SET revoked_at = ?
449        WHERE id = ? AND user_id = ?
450    """, datetime.utcnow(), key_id, current_user["id"])
451 
452    return {"message": "API key revoked"}
453```
454 
455---
456 
457## Part 5: Session-Based Authentication
458 
459### Session Implementation
460 
461```python
462from fastapi import FastAPI, Cookie, Response
463import redis
464import secrets
465import json
466 
467app = FastAPI()
468redis_client = redis.Redis(host='localhost', port=6379, decode_responses=True)
469 
470def create_session(user_id: int) -> str:
471    """Create session and return session ID."""
472    session_id = secrets.token_urlsafe(32)
473 
474    session_data = {
475        "user_id": user_id,
476        "created_at": datetime.utcnow().isoformat()
477    }
478 
479    # Store in Redis with 24-hour expiry
480    redis_client.setex(
481        f"session:{session_id}",
482        86400,  # 24 hours
483        json.dumps(session_data)
484    )
485 
486    return session_id
487 
488def verify_session(session_id: str) -> dict:
489    """Verify session and return user data."""
490    session_data = redis_client.get(f"session:{session_id}")
491 
492    if not session_data:
493        raise HTTPException(status_code=401, detail="Session expired")
494 
495    return json.loads(session_data)
496 
497@app.post("/login")
498async def login(username: str, password: str, response: Response):
499    user = authenticate_user(username, password)
500    if not user:
501        raise HTTPException(status_code=401, detail="Invalid credentials")
502 
503    # Create session
504    session_id = create_session(user.id)
505 
506    # Set httpOnly cookie
507    response.set_cookie(
508        key="session_id",
509        value=session_id,
510        httponly=True,
511        secure=True,
512        samesite="lax",
513        max_age=86400  # 24 hours
514    )
515 
516    return {"message": "Logged in successfully"}
517 
518@app.get("/protected")
519async def protected_route(session_id: str = Cookie(None)):
520    if not session_id:
521        raise HTTPException(status_code=401, detail="Not authenticated")
522 
523    session_data = verify_session(session_id)
524    user_id = session_data["user_id"]
525 
526    return {"message": f"Hello user {user_id}"}
527 
528@app.post("/logout")
529async def logout(session_id: str = Cookie(None), response: Response):
530    if session_id:
531        redis_client.delete(f"session:{session_id}")
532 
533    response.delete_cookie("session_id")
534    return {"message": "Logged out successfully"}
535```
536 
537---
538 
539## Part 6: Password Security
540 
541### Password Hashing (Never Store Plain Text!)
542 
543```python
544import bcrypt
545 
546def hash_password(password: str) -> str:
547    """Hash password with bcrypt."""
548    salt = bcrypt.gensalt(rounds=12)  # 12 rounds is good balance
549    hashed = bcrypt.hashpw(password.encode('utf-8'), salt)
550    return hashed.decode('utf-8')
551 
552def verify_password(password: str, hashed: str) -> bool:
553    """Verify password against hash."""
554    return bcrypt.checkpw(password.encode('utf-8'), hashed.encode('utf-8'))
555 
556# When creating user
557@app.post("/register")
558async def register(username: str, password: str):
559    # Validate password strength
560    if len(password) < 12:
561        raise HTTPException(status_code=400, detail="Password must be at least 12 characters")
562 
563    # Hash password
564    hashed_password = hash_password(password)
565 
566    # Store hashed password (NEVER plain text!)
567    db.execute("""
568        INSERT INTO users (username, password_hash)
569        VALUES (?, ?)
570    """, username, hashed_password)
571 
572    return {"message": "User created"}
573 
574# When logging in
575@app.post("/login")
576async def login(username: str, password: str):
577    user = db.execute("SELECT id, password_hash FROM users WHERE username = ?", username).fetchone()
578 
579    if not user:
580        raise HTTPException(status_code=401, detail="Invalid credentials")
581 
582    # Verify password
583    if not verify_password(password, user[1]):
584        raise HTTPException(status_code=401, detail="Invalid credentials")
585 
586    # Create token/session
587    access_token = create_access_token(user[0])
588    return {"access_token": access_token}
589```
590 
591### Password Requirements
592 
593**Minimum requirements**:
594- At least 12 characters (NIST recommendation)
595- Mix of uppercase, lowercase, numbers, symbols
596- Not in common password list
597- Not similar to username
598 
599**Implementation**:
600```python
601import re
602 
603def validate_password(password: str, username: str) -> tuple[bool, str]:
604    """Validate password strength."""
605    if len(password) < 12:
606        return False, "Password must be at least 12 characters"
607 
608    if not re.search(r"[a-z]", password):
609        return False, "Password must contain lowercase letter"
610 
611    if not re.search(r"[A-Z]", password):
612        return False, "Password must contain uppercase letter"
613 
614    if not re.search(r"\d", password):
615        return False, "Password must contain number"
616 
617    if not re.search(r"[!@#$%^&*(),.?\":{}|<>]", password):
618        return False, "Password must contain special character"
619 
620    if username.lower() in password.lower():
621        return False, "Password cannot contain username"
622 
623    # Check against common passwords
624    if is_common_password(password):
625        return False, "Password is too common"
626 
627    return True, "Password is strong"
628```
629 
630---
631 
632## Part 7: Common Vulnerabilities
633 
634### Vulnerability 1: Token Replay Attacks
635 
636**Problem**: Attacker intercepts token and reuses it
637 
638**✅ Solution**: Short expiration + refresh tokens
639```python
640# Access token: 15 minutes
641# Refresh token: 7 days, single-use
642 
643def refresh_tokens(refresh_token: str):
644    # Verify refresh token
645    payload = jwt.decode(refresh_token, SECRET_KEY)
646 
647    # Check if already used (store used tokens in Redis)
648    if redis_client.get(f"used:{refresh_token}"):
649        raise HTTPException(status_code=401, detail="Token already used")
650 
651    # Mark as used
652    redis_client.setex(f"used:{refresh_token}", 604800, "1")  # 7 days
653 
654    # Generate new tokens
655    user_id = int(payload["sub"])
656    new_access = create_access_token(user_id)
657    new_refresh = create_refresh_token(user_id)
658 
659    return {"access_token": new_access, "refresh_token": new_refresh}
660```
661 
662### Vulnerability 2: CSRF Attacks
663 
664**Problem**: Attacker tricks user into making authenticated request
665 
666**✅ Solution**: CSRF tokens + SameSite cookies
667```python
668from fastapi import Cookie, Header
669 
670def verify_csrf(
671    csrf_token: str = Header(None, alias="X-CSRF-Token"),
672    session_id: str = Cookie(None)
673):
674    """Verify CSRF token matches session."""
675    if not csrf_token:
676        raise HTTPException(status_code=403, detail="CSRF token missing")
677 
678    session_data = verify_session(session_id)
679    stored_csrf = session_data.get("csrf_token")
680 
681    if csrf_token != stored_csrf:
682        raise HTTPException(status_code=403, detail="Invalid CSRF token")
683 
684@app.post("/sensitive-action")
685async def sensitive_action(
686    csrf_check: None = Depends(verify_csrf)
687):
688    # Action protected from CSRF
689    pass
690```
691 
692### Vulnerability 3: Timing Attacks
693 
694**Problem**: Attacker uses response timing to guess credentials
695 
696**✅ Solution**: Constant-time comparison
697```python
698import hmac
699 
700def constant_time_compare(a: str, b: str) -> bool:
701    """Compare strings in constant time (prevents timing attacks)."""
702    return hmac.compare_digest(a, b)
703 
704# Use for password hash comparison
705if not constant_time_compare(provided_hash, stored_hash):
706    raise HTTPException(status_code=401)
707```
708 
709---
710 
711## Part 8: Rate Limiting
712 
713```python
714from fastapi import Request
715import time
716 
717# In-memory rate limiter (use Redis for production)
718rate_limits = {}
719 
720def rate_limit(max_requests: int, window_seconds: int):
721    """Rate limit decorator."""
722    def decorator(func):
723        async def wrapper(request: Request, *args, **kwargs):
724            client_ip = request.client.host
725            key = f"{client_ip}:{func.__name__}"
726 
727            now = time.time()
728 
729            if key not in rate_limits:
730                rate_limits[key] = []
731 
732            # Remove old requests outside window
733            rate_limits[key] = [
734                req_time for req_time in rate_limits[key]
735                if now - req_time < window_seconds
736            ]
737 
738            # Check if over limit
739            if len(rate_limits[key]) >= max_requests:
740                raise HTTPException(
741                    status_code=429,
742                    detail=f"Rate limit exceeded. Try again in {window_seconds} seconds."
743                )
744 
745            # Add current request
746            rate_limits[key].append(now)
747 
748            return await func(request, *args, **kwargs)
749        return wrapper
750    return decorator
751 
752@app.post("/login")
753@rate_limit(max_requests=5, window_seconds=60)  # 5 login attempts per minute
754async def login(request: Request, username: str, password: str):
755    # Login logic
756    pass
757```
758 
759---
760 
761## Quick Security Checklist
762 
763**Token Security**:
764- [ ] Always use HTTPS (never HTTP)
765- [ ] Set token expiration (15 min for access, 7 days for refresh)
766- [ ] Store secrets in environment variables
767- [ ] Hash API keys before storing
768- [ ] Use httpOnly cookies for tokens
769- [ ] Never store sensitive data in JWT payload
770 
771**Password Security**:
772- [ ] Use bcrypt or argon2 for hashing
773- [ ] Enforce minimum 12 characters
774- [ ] Never store plain text passwords
775- [ ] Use constant-time comparison
776- [ ] Implement rate limiting on login
777 
778**API Security**:
779- [ ] Validate all inputs
780- [ ] Implement rate limiting
781- [ ] Use CORS restrictions
782- [ ] Add CSRF protection for state-changing operations
783- [ ] Log authentication events
784- [ ] Monitor for suspicious patterns
785 
786---
787 
788## Resources
789 
790**JWT**:
791- JWT.io: https://jwt.io/
792- RFC 7519: https://tools.ietf.org/html/rfc7519
793 
794**OAuth 2.0**:
795- OAuth 2.0 RFC: https://tools.ietf.org/html/rfc6749
796- OAuth 2.0 Playground: https://www.oauth.com/playground/
797 
798**Security**:
799- OWASP Auth Cheatsheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
800- NIST Password Guidelines: https://pages.nist.gov/800-63-3/
801 
802**Libraries**:
803- PyJWT: https://pyjwt.readthedocs.io/
804- Authlib: https://docs.authlib.org/
805- Passlib: https://passlib.readthedocs.io/
806