Security

Authorization code flow, PKCE for public clients, access/refresh token lifecycle, OIDC identity layer, and token revocation strategies

Header.payload.signature structure, HS256 vs RS256 key models, stateless validation, JWKS key distribution, and alg:none / key-confusion attacks

API keys (hashed storage), HMAC request signing (replay prevention), mTLS for microservices, JWT Bearer tokens, and scheme selection by caller trust level