An overview of the OIDC Conformant authentication flows, why these changes were made and how you can adopt them.
https://auth0.com/docs/api-auth/intro#how-to-use-the-new-flows
* new features
* what changed
* distinguish which authentication flow is used
* summarizing table
* links for further reading
* What’s New
* How to use the new flows
* SAML or WS-Federation identity provider
* Dynamic Client Registration
* Why you should always use Access Tokens to secure an API
* standard OIDC scopes
* defined by the OIDC Specification
* API
* conform to a namespaced format
* OAuth 2.0 grants
* JWT
* /userinfo endpoint
* Use prompt=none instead
* cryptographically secure random string
* validate the nonce to mitigate replay attacks
* JWT
* /userinfo endpoint
* /oauth/token
* Auth0's own grant type
* standard OIDC password grant
* JWT
* /userinfo endpoint
* public client
* Delegation
* ID Tokens should no longer be used as API tokens
* Refresh Tokens should be used only at the token endpoint
* OIDC-conformant
* /tokeninfo
* /userinfo
* /oauth/access_token
* /oauth/access_token
* Google and Facebook are recommending
* /oauth/ro
* Call APIs from Highly Trusted Clients
* /authorize
* /token
* Dashboard
* Clients