IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Start here: the life of a token
After Maya signs in, the system gives her a small digital pass. That pass is the token. Apps show it to an API on every call. Your goal: follow one token from its birth to the moment an API trusts it.
- Almost every sign-in word is built around the token.
- If you guard the token well, most attacks fail.
- One stolen token can open many doors.
A cinema ticket. You buy it once at the counter. The gate staff look at it and let you in. They do not ask who you are again. But if a thief copies your ticket, they may walk in too. This track follows that ticket. How is it made? How is it checked? What if it is copied? How do we cancel it?
The 11 lessons
- Getting a token — how it is made, with the authorization code flow and PKCE.
- ID tokens vs access tokens — one is for the app, one is for the API.
- Refresh-token rotation — a leaked refresh token sets off an alarm, with rotation.
- Stolen-token defenses I — cancel a stolen token and shorten its life.
- Stolen-token defenses II — make a copied token useless.
- CAEP & Shared Signals — one alert from CAEP logs you out of every app.
- Claims you can trust — which facts in a token a user can edit.
- Validating a JWT — check a JWT like an API does.
- Opaque tokens & introspection — the opaque token, which can be canceled at once.
- The big picture — one token's whole life.
- Cheat sheet & pop quiz — the track in short, then a quiz.
How to use it
Take one lesson at a time. Your progress is saved in your browser. Most lessons have a hands-on lab.
You will know which defenses still work after a theft. For pulling access fast, see when things go wrong.
Start with getting a token.