Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token
Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token lifecycle management, scope design, and alignment with OAuth 2.1 security requirements.
PKCE (RFC 7636) prevents authorization code interception attacks:
code_verifier (43-128 characters, unreserved URI chars)code_challenge = BASE64URL(SHA256(code_verifier))code_challenge and code_challenge_method=S256code_verifierSHA256(code_verifier) matches stored code_challengeread:users, write:orders, admin:settings| Control | NIST 800-53 | Description |
|---|---|---|
| Access Control | AC-3 | Token-based access enforcement |
| Authentication | IA-5 | Client credential management |
| Session Management | SC-23 | Token lifecycle management |
| Audit | AU-3 | Log all token issuance and revocation |
| Cryptographic Protection | SC-13 | PKCE and token signing |