OAuth2

Authenticate service-to-service API calls

Explains API keys, client credentials, managed identity, mTLS, scopes, rotation, and per-client observability.

Authentication vs authorization in ASP.NET Core APIs

Separates identity establishment from permission decisions and applies ASP.NET Core schemes, policies, tenant boundaries, ownership checks, and correct challenge or forbid behavior.

Compare access tokens and refresh tokens

Explains short-lived access tokens, refresh-token rotation, revocation, storage choices, and replay detection.

Debug 401 vs 403 failures in ASP.NET Core APIs

Debugs ASP.NET Core authentication challenges and authorization forbids across schemes, token validation, policies, claims, tenants, and resource checks.

OAuth 2.0, OpenID Connect, and authorization code with PKCE

Separates OAuth authorization from OpenID Connect authentication and explains why modern interactive clients use authorization code with PKCE.

Security boundaries between client, API, and identity provider

Separates identity issuance, untrusted client behavior, API authorization, tenant isolation, resource checks, and token-handling responsibilities.

API Security & Auth

Authentication, authorization, tokens, tenant boundaries, and API protection.

A practical API security track covering login flows, JWT validation, refresh tokens, session revocation, external identity providers, roles and capabilities, resource ownership, tenant isolation, policy authorization, admin audit, stale claims, service-to-service auth, CORS, CSRF, rate limiting, overposting, safe errors, secrets, and browser-facing security controls.