I didn't understand OAuth until I did this
Yesterday I learned something crucial. I finally understand how OAuth works. I'm a little bit ashamed to admit it, but even though I have worked with auth providers quite a bit, I never took the time to fully understand what they actually do. I've deployed Keycloak to production environments. I've set up countless Enterprise Applications and App Registrations in Azure. I've configured client secrets, helped people fix scopes. All without really understanding what it truly meant, and what goes on under the hood. Sometimes, there is not enough time to dive deeper, because there is always much more to learn. As long as my customers were able to log in to Keycloak and it was running properly, I had done my job. But yesterday I finally took the time to understand more about it, and I was a bit baffled with how simple it is. I'm working on a new project for KubeCraft and I decided I'm going to write a proper API for it in Python using FastAPI. But this time I wanted my endpoints to be secured properly. The FastAPI tutorial is truly a gem. The same goes for Typer for creating CLI's. If you are looking to dive deeper into Python, I highly recommend this resource. Simply by going through the Security tutorial, I learned step by step what happens when we go through an OAuth flow. I learned that there really isn't much magic to it: JWT is actually very simple. It's tokens that are signed with a secret, and they can be verified by the server that created them. Very similar to SSH keys. After a bit of study I figured out how token refreshing works, and I was almost done. After learning this, I was able to create an API where only users with a valid token can get responses from the API, and my mission was accomplished. I wish I had done this years ago. It's a great project which will help with your general understanding of how applications work. Did you have any breakthrough moments? Did you ever do a simple project, which gave you a great amount of learning?