Free & open · no paywall, ever

IntegrAuth Academy

Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.

20 tracks 241 lessons 242 hands-on labs 230+ diagrams 100% free

English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.

How?
  • Chrome on phone: ⋮ menu → Translate
  • Chrome on computer: right-click → Translate to …
  • Edge: the translate icon in the address bar
Identity & API Security Track 13 · Identity Architecture
0/166 lessons read
ARCHITECTURE · LESSON 7

The big picture

This track had no new mechanism. It was about the calls that turn everything you learned into one working system. You made six calls. Here they are on one page.

The story you just lived

It started with a school-fees app and a token in Maya's browser. Where do you put it? That is the BFF: the server holds the real tokens, and the browser gets only a session cookie. In identity across microservices, one food order crossed four services. You checked the user once at the edge. Then you passed narrow tokens over mutual TLS.

In multi-tenancy, a clinic system kept each clinic's data apart. The tenant claim guarded every read, list and write on the server. In token lifetimes, a short life plus fast revocation gave you safety and ease.

Then came the biggest call: build vs buy, for a food-delivery startup. Last, the 9 a.m. sale-day outage in when identity goes down. Graceful degradation, a health-checked standby and a break-glass door kept signed-in users working. An admin could still run the incident.

Browser (SPA)holds a wristbandBFFtokens live hereGatewayvalidate onceat the edgeServicesexchange · mTLStenant-scopedIdPshort lifetimesfailover · break-glasshand out the least · keep the keys elsewhere · plan for it to failIdP issues short-lived tokens →
Figure — Six decisions, one system. Tokens stay out of the browser, behind a BFF. The gateway checks once. Services trade narrow, tenant-scoped tokens over mutual TLS. The IdP issues short-lived tokens, with a standby and a break-glass path. The whole system stands when one piece falls.

The threads that tie it together

Hand out the least

The browser never holds the real tokens. See the BFF and identity across microservices.

One missing line can end a company

Isolation is a server-side check on every object, not a hidden button. See multi-tenancy.

Every credential is a dial

Longer tokens survive both a thief and an outage. Use a modest window plus fast revocation. See token lifetimes and resilience.

Build or buy, but use standards

OIDC, SAML and SCIM keep the door open. See build vs buy.

Why it matters

You can now join an architecture review and make the calls with confidence. You also know what each call costs.

One idea behind all of it

If one idea runs through every decision, it is zero trust: never assume, always verify, at every layer. NIST SP 800-207 says there is no implicit trust from network location alone.

Where to go next

This is the last track of the program, so there is no next track. Here is what to do, in order:

  1. Read the cheat sheet and pop quiz. It is the last page before the hub.
  2. Keep practicing with the Daily drill, the Flow Explorer and Challenge mode.
  3. Take the Final Exam. It covers every track in this program and earns your certificate.
  4. Practice on live systems in the Lab.
  5. Start the second program, Practical AI, with AI from Zero.