View reading-notes on GitHub

Bearer Authorization

Bearer authentication (also called token authentication) is an HTTP authentication scheme that involves security tokens called bearer tokens. The name “Bearer authentication” can be understood as “give access to the bearer of this token.” The bearer token is a cryptic string, usually generated by the server in response to a login request

Write the following steps in the >

correct order:

  1. Register your application to get a client_id and client_secret.
  1. Ask the client if they want to sign in via a third party.
  1. Redirect to a third party authentication endpoint.
  1. Make a request to a third-party API endpoint
  1. Receive authorization code.
  1. Make a request to the access token endpoint.
  1. Receive access token.

## What can you do with an authorization code?

An authorization code is an alphanumeric password that authorizes its user to purchase, sell or transfer items, or to enter information into a security-protected space.

Access tokens are the thing that applications use to make API requests on behalf of a user. The access token represents the authorization of a specific application to access specific parts of a user’s data. Access tokens must be kept confidential in transit and in storage .

What can you do with an access token?

Access tokens are the thing that applications use to make API requests on behalf of a user. The access token represents the authorization of a specific application to access specific parts of a user’s data. Access tokens must be kept confidential in transit and in storage.

What’s a benefit of using OAuth instead of your own basic authentication?

It enables apps to obtain limited access (scopes) to a user’s data without giving away a user’s password. It decouples authentication from authorization and supports multiple use cases addressing different device capabilities. It supports server-to-server apps, browser-based apps, mobile/native apps, and consoles/TVs.

Document the following Vocabulary Terms

  1. Client ID

    Your client ID , also referred to as a UCI , is on all documents you get from us. It is an eight or ten-digit number that looks like this: 0000-0000 or 00-0000-0000. If you are applying to us for the first time, you will not yet have a client ID.

  2. Client Secret

    A client secret is a secret known only to your application and the authorization server. It protects your resources by only granting tokens to authorized requestors. Protect your client secrets and never include them in mobile or browser-based apps.

  3. Authentication Endpoint

    Endpoint authentication is a security mechanism designed to ensure that only authorized devices can connect to a given network, site or service. The approach is also known as device authentication. … Authenticating both the user and the device can provide two-factor authentication (2FA)

  4. Access Token Endpoint

    The token endpoint is where apps make a request to get an access token for a user. This section describes how to verify token requests and how to return the appropriate response and errors. Authorization Code. Password Grant. Client Credentials.

  5. API Endpoint

    An API endpoint is a point at which an application program interface (API) – the code that allows two software programs to communicate with each other – connects with the software program. APIs work by sending requests for information from a web application or web server and receiving a response.

  6. Authorization Code

    The authorization code is a temporary code that the client will exchange for an access token. The code itself is obtained from the authorization server where the user gets a chance to see what the information the client is requesting, and approve or deny the request.

  7. Access Token

    Access tokens are the thing that applications use to make API requests on behalf of a user. The access token represents the authorization of a specific application to access specific parts of a user’s data. Access tokens must be kept confidential in transit and in storage.

APIDOC

Dev QA

Javas Guides

stackoverflow

so the thing is what you abeal to do and achive to undersatnd your coworker team

for more info please visit my github qusaiqeisi

best regard