IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
The big picture
This track showed the how behind a login. You saw the real messages that fly when Maya taps "Log in". This page puts the whole protocol zoo on one map before the quiz.
The story you just lived
You slowed down one login and studied each frame. The front channel carried a worthless authorization code through her browser. The back channel swapped it for tokens. Then you met SAML, where a signed assertion travels through the browser all day. Signing out was the other half: one tap must end the IdP session, every app session and the tokens.
Next you removed the person. Bot A logs in as itself with client credentials. The device flow let a TV borrow Maya's phone. With token exchange, one app can act for Maya and say so.
You handled Sam's first login with JIT provisioning and account linking. Under all of this ran federation trust: discovery documents, published keys (JWKS) picked by kid, and one issuer string you must never change. You also met PKCE and sender-constrained tokens. For banks, PAR, JAR and FAPI empty the front channel. The Flow Explorer plays each flow step by step.
Five pictures to remember
- 🛍️ "Sign in with Google" on a shopping app: the auth-code flow.
- 🏢 A payroll app that trusts the office login: SAML.
- 📺 A TV app with a short code, like a UPI QR: the device flow.
- 🤖 A bot that signs like a cheque signature: client credentials.
- 🏫 The campus office that tells every department you left: sign-out.
Four threads
Front channel vs back channel
A login is safe or not by the lane each message uses. The auth-code flow and SAML send something worthless up front. Machine login can keep the secret off the network. Know the lane, and you know what an attacker can see.
No person, still a proof
Each flow swaps the browser step for a proof that can be checked: a machine key, a phone, or an actor claim.
Trust is set up once
Parties swap metadata and keys one time. After that, assertions and tokens flow on their own. First arrivals use that same trust.
The issuer string is a wall
Never change the issuer. Never link accounts by an unverified email. Only read the element that a signature covers.
Now you can pick the right flow for a person, a robot or a TV. You can find which step broke in a failed login. And you can say where secrets live.
Where these ideas go next
Human-in-the-loop approvals use CIBA to make an agent wait for your yes. Cross-account federation stretches the same trust across clouds. Identity disaster recovery asks what happens when the IdP goes down.
Ready? The cheat sheet and pop quiz is next.