#authentication

Two things would prevent most OAuth bugs. OAuth answers what a caller may access, not who they are, so using it to log people in is a category error. And the flow chart everyone agonised over has collapsed: authorization code plus PKCE, for every client type, no exceptions.

JWTs are the default choice for new apps and usually the wrong one. The reason is revocation: there is no row to delete. And the standard fix, a server-side denylist, reintroduces the database lookup that was the entire point of going stateless.

An API is the contract that lets one piece of software ask another for something without knowing how it works inside. Here is what that means, from the waiter analogy down to endpoints, JSON, keys, and rate limits, plus why APIs quietly run the whole economy.