Server to server authentication has the simplest flow, using the client credentials flow. However, this reduces the security of the connection, so it is important to add extra levels to ensure the identity of the calling server. Private Key JWT client authentication adds extra security and is a more modern…

This is a “primer” page for existing developers, to help orientate you when reading up about OAuth solutions. You might notice that on this page (and the example pages), I’m trying to avoid some of the key terms set out in OAuth / OIDC. The reason for this, is to…

For very simple apps, especially where you don’t need an active server, then a Single Page App is a good solution. OIDC allows you to secure your application with someone else’s authentication and identity information (such as Facebook). You don’t have anything heavy weight to implement at your end! Previously…

Some OAuth providers enable you to reuse the authentication of an OIDC provider. If you trust that OIDC provider, have only simply requirements, then it can save your application from managing it’s own user database. The NHS Digital API Platform has a similar option, and this example walks through how…