Free & open · no paywall, ever

IntegrAuth Academy

Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.

Choose your program Browse the 20 tracks
20 tracks 241 lessons 242 hands-on labs 230+ diagrams 100% free

English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.

How?
  • Chrome on phone: ⋮ menu → Translate
  • Chrome on computer: right-click → Translate to …
  • Edge: the translate icon in the address bar
Identity & API Security Track 0 · The Absolute Basics
0/166 lessons read
THE ABSOLUTE BASICS · LESSON 10

The big picture

Nine lessons ago a page on your screen was magic. Now you can name every step. Let us replay one moment: Maya books a flight at travel.example.

The story you just lived

Maya types travel.example and presses enter. Her browser first finds the place with a DNS lookup (how the web works). Then two computers talk in HTTP. A request goes out. A numbered answer comes back: 200 OK.

She signs in and clicks "my bookings". The server does not ask "who are you?" again. It uses the name-tag from cookies & sessions. She typed her password once. The server gave back a cookie. Now the cookie rides along on every request.

Under the page, her app trades data using the menu from APIs. These are small JSON notes, not whole pages. You can now tell apart the three words from encoding, encryption & hashing. Base64 repacks but hides nothing. Encryption really locks. Hashing makes a one-way fingerprint.

The padlock uses a key pair. A public key is for anyone to use. A private key stays with its owner (keys & the padlock). Signatures make any change easy to see. The pass Maya carries is the JWT. Anyone can read it, but nobody can fake it. Her password? The site stored only a salted, slow fingerprint (passwords).

Last, you learned to spot a fake. Read a link from the right, and never share an OTP.

Maya's browsertypes travel.exampleDNS → addressname becomes a numberHTTP request200 · here's the pageCookie + JWTstill Maya, no re-loginevery step rides on thisUnder the padlock — the machinery you can now seeBase64 repackages (never hides) · slow hashing guards the password · a key pair seals the token
Figure — One visit, every idea. Left to right is the trip Maya feels as instant. She finds the address, speaks HTTP, and leaves with a cookie and a token. All of it rests on the band below. That band is the encode, hash and key-pair machinery that keeps it honest.

The threads that tie it together

The forgetful web, patched

Each request stands alone. This fact from HTTP is why cookies and tokens exist. Sessions and the JWT both tell a forgetful server "it is still me."

Scrambled does not mean secret

Encoding only repacks. So anyone can read the middle of a JWT. The padlock guards the line, not the shop at the other end. For secrecy, use encryption or hashing.

Software talking to software

APIs serve JSON, not screens. A request with no proof is turned away. So the caller carries an API key or a token.

The secret you never store

A site keeps a password's fingerprint, not the password. Your private key is never sent to the site. Nothing worth stealing sits where a thief can reach it.

Why it matters

This is the base everything else stands on. Once "server", "request", "cookie", "token", "encode" and "hash" are everyday words, the deeper tracks get much easier.

Where these ideas go next

The Foundations track uses these pieces to ask two questions. Who are you? What may you do? For the real checks an API runs on a JWT, see validating a JWT. To see what replaces the password, start with passkeys.

Feeling sure? The cheat sheet & pop quiz is one page away.