Interactive · 7 lessons
Learn API authentication
by trying it, not reading it.
Sign a JWT. Generate an API key. Walk through an OAuth handshake. Every lesson pairs a plain-English explainer with a demo you can poke at.
Your progress
0%
0/7
Basic Auth—
API Keys—
JWT—
Email/Password—
OAuth 2.0 / OIDC—
SSO / SAML—
mTLS—
Pick a mechanism
Beginner
HTTP Basic Authentication
Username + password sent in a header — the oldest scheme still in use.
Start
Beginner
API Keys
A single opaque token identifies the caller. Simple, ubiquitous, easy to leak.
Start
Intermediate
JSON Web Tokens (JWT)
Signed, tamper-evident claims a client carries on every request.
Start
Beginner
Email & Password + Verification
Classic signup flow, made safe with email verification and hashing.
Start
Advanced
OAuth 2.0 & OpenID Connect
Delegated access + identity. The protocol behind “Sign in with Google”.
Start
Advanced
Single Sign-On (SAML)
One identity provider, many apps — the enterprise standard.
Start
Advanced
Mutual TLS (mTLS)
Both client and server prove identity with cryptographic certificates.
Start
About this app
Built for engineers who want to actually understand auth.
Read more
Loaded 0 progress rows