IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
The big picture
A small pass is made at login, and every app trusts it. Now you know its whole life. This page ties the lessons into one story before the quiz.
- A token is born, lives, may be stolen, and is checked.
- Only the layers together save a leaked token.
- The server is the control. Verify before you believe.
The story you just lived
Birth. Maya tapped "Sign in". On a private back channel, a fresh pair of tokens was born. The app swapped a one-time code and showed a PKCE verifier. Each token has one reader, and the audience says who (ID tokens vs access tokens).
Life and theft. Every use rotated the refresh token. A replayed old copy canceled the whole family. A copied access token still works until it expires. So you learned server-side ways to refuse it. Then you tied it to a key with DPoP or mTLS, so a stolen bearer token is a dead number. One signed signal from CAEP then dropped Priya's sessions in every app.
Trust. You drew the border. Users may change cosmetics. Only the platform sets entitlements. At the API, you ran the token through the four gates: signature, issuer, audience and expiry. Last, you met the opaque token. It means nothing until the issuer vouches for it, through introspection.
Three threads
The server is the control
The API enforces the revocation marker, the trust border and the validation gates. A personalized page is only a picture.
Make the copy worthless
PKCE disarms a stolen code. Rotation disarms a replayed refresh token. Sender-constraining disarms a copied bearer token.
Verify before you believe
A token is only a claim until you check it. Use validation, introspection and trusted claims.
Now you can place any token bug on the timeline. Was the code stolen? Was the refresh token replayed? Was a gate skipped? Then you reach for the matching defense.
Where these ideas go next
A token shows who is asking. It does not say what that caller may touch. That is scopes and least privilege. Also see token lifetimes and workload identity federation.
Feeling solid? The cheat sheet & pop quiz is next.