OAuth 2.0 Deep Dive | Open ID Connect | PKCE, Device Flow, Client Credential Grant | Google Usecase
0:00 - Introduction: Why This Video Changes Everything
Stop memorizing diagrams. This is the only OAuth 2.0 & OIDC deep dive that connects theory to real-world security nightmares and solutions. If you've ever been confused by "PKCE," "Device Flow," or why "Login with Google" works the way it does — this is your definitive guide.
0:39 - The Dark Ages of Auth: Passwords in Plain Text (The Problem That Started It All)
How apps stole your Google password 20 years ago. Learn why storing credentials in third-party apps was a catastrophic security flaw — leading directly to the birth of OAuth standards.
6:27 - OAuth 1.0: The First Attempt (And Why It Failed)
Consumer Keys, Secrets, and Verifiers — the original solution. Discover why this system became unusable with the rise of mobile apps and reverse engineering risks.
11:11 - OAuth 2.0 vs. OpenID Connect (OIDC):
Crucial Insight: OAuth = What you can do. OIDC = Who you are.
Real examples: WhatsApp (OAuth only) vs. Netflix (OAuth + OIDC). Understand scopes, identity, and why OIDC runs on top of OAuth 2.0.
15:56 - Client ID, Secret, Redirect URI & PKCE Explained
Break down the 4 pillars of application identity:
Client ID: Public app identifier
Client Secret: The app’s password (for confidential clients)
Redirect URI: Where the auth server sends you back
PKCE (Proof Key for Code Exchange): The modern hero preventing token theft
23:44 - The Two Types of Clients: Confidential vs. Public
Confidential Client (e.g., Netflix Server): Can securely store secrets. Uses Authorization Code Flow.
Public Client (e.g., Spotify Mobile App): Cannot hide secrets. Uses Authorization Code Flow + PKCE.
30:45 - PKCE: Shield Against MITM Attacks
Step-by-step walkthrough of how PKCE stops attackers from stealing authorization codes.
Code Verifier vs. Code Challenge. SHA-256 hashing. Why even if an attacker sniffs your code, they still can’t get a token. This is mandatory in OAuth 2.1.
44:04 - Device Flow: Signing In Smart TVs, IoT Devices
How Apple TV, Android TV, or smart fridges authenticate users using only a remote.
The magic: User Code + Device Code + Your Phone as a Proxy.
See exactly how polling works and why this flow is secure even if someone steals your 6-digit code.
53:29 - Refresh Tokens: Never Log Out Again
Why access tokens expire (1 hour), and how refresh tokens silently renew them without bothering the user. Walkthrough of the grant_type=refresh_token request.
1:19:35 - OpenID Connect (OIDC): Getting User Identity
How “Sign in with Google” shows your name, email, and profile picture instantly.
The game-changer: ID Token (a JWT) alongside the Access Token. Decode it. See your claims. No extra API call needed.
1:21:53 - The 5 Major OAuth 2.0 Flows: Summary & When to Use Which
✅ Authorization Code Flow: Web apps with backend servers (Netflix).
✅ Authorization Code + PKCE: Mobile apps, SPAs, desktop apps (Spotify, Canva).
❌ Implicit Flow: DEPRECATED. Don’t use it.
✅ Client Credentials Flow: Machine-to-machine (microservices talking to APIs).
✅ Device Flow: Smart TVs, IoT devices, consoles (YouTube on Apple TV).
1:23:00 - Final Thoughts & Next Steps
You now understand the entire ecosystem. Remember: Security isn’t about complexity — it’s about choosing the right flow for your client type. Bookmark this video. Revisit it before your next auth implementation.