Hardcoded secrets, unverified tokens, and other common JWT mistakes
Interesting article. On this note, recently as part of small group of people we needed to implement API -&gt; API authentication. Unfortunately, we don&#x27;t have anyone who has solely implemented this before, so we took to searching to try and pick something resembling industry standards. Of course Oauth 2 got brought up, however the spec and articles on it seem bizarrely out of sync with out needs. Notably on two points:<p>1. It seems any piece of content talking about Oauth 2 is referring to 3rd party, external authentication. Ie i want a client API to talk to my API but with an identity managed by a third party entirely. This is not our use case, but seems to be the primary focus for Oauth 2 articles.<p>2. The rest of the spec _feels_ very loose for our use case. There&#x27;s loose definitions _(it feels like)_ on some basic patterns of tokens and renewal tokens, but it all seems so wildly flexible that we&#x27;re almost lost on what to actually write, what technologies to use to generate tokens, etc.<p>Any tips for narrowing the field, to implement the right thing, in the right way? This article struck a chord with me.