Identity and API Security Resources
The primary sources and tools worth bookmarking. No embedded videos and no downloads; just links to the documents that matter.
Core specifications
| Topic | Document |
|---|---|
| OAuth 2.0 | RFC 6749, RFC 6750 (bearer tokens) |
| OAuth security | RFC 9700 (Best Current Practice, 2025) |
| OAuth 2.1 (draft) | draft-ietf-oauth-v2-1 |
| PKCE | RFC 7636 |
| Native apps | RFC 8252 |
| JWT | RFC 7519, RFC 8725 (best practices) |
| OpenID Connect | Core 1.0, Discovery 1.0 |
| SAML 2.0 | OASIS SAML 2.0 specifications |
| SCIM 2.0 | RFC 7643, RFC 7644 |
| XACML 3.0 | OASIS XACML 3.0 core |
| HSTS | RFC 6797 |
| TLS | RFC 8446 (TLS 1.3), RFC 9325 (recommendations) |
| WebAuthn | W3C Web Authentication |
Guidance and checklists
- NIST SP 800-63-4 Digital Identity Guidelines
- NIST SP 800-207 Zero Trust Architecture
- OWASP API Security Top 10 (2023)
- OWASP Cheat Sheet Series (authentication, authorization, SAML, OAuth)
On this site
- Topic guides and IAM building blocks
- Platform category guides
- In-depth guides index
- Glossary and blog archives
Older video pages that once lived under /resources/video/ were not brought back; their addresses lead here.
Free tools
JWT Decoder & Inspector
Decode a JWT's header and claims, check expiry, spot risky algorithms and verify HS256 signatures locally.
PKCE Generator
Create a code_verifier and its S256 code_challenge, plus random state and nonce values, with WebCrypto.
SAML Response Decoder
Decode POST and Redirect binding messages, pretty-print the XML and pull out issuer, subject, conditions and attributes.
Authorization URL Builder
Build an OAuth 2.0 or OpenID Connect authorize URL parameter by parameter, with warnings for insecure combinations.
Security Header Builder
Generate HSTS, CSP, Referrer-Policy and nosniff headers for nginx, Apache, IIS, Jetty and static hosts.