🛡️ Security

OAuth Authorization Server

The OAuth 2.0 component that authenticates users, obtains their consent and issues access, refresh and ID tokens to client applications. It holds token signing keys, client secrets and the token store, so its compromise lets an attacker mint tokens that every resource server trusts without any login taking place.

📚 Deep Dive

Learn Article

Why the Server That Issues Your Access Tokens Is a Tier-0 Asset

An OAuth authorization server holds the signing keys and secrets every application trusts. Why compromise is silent, why it gets misclassified, and what treating it like a domain controller means.

intermediate 6 min read

Back to Glossary