Mobile apps should use Authorization Code with PKCE. They can't securely store client secrets (can be decompiled), and Implicit is deprecated. PKCE provides security without requiring a secret.

Tokens in URLs (from Implicit flow) leak through browser history. Authorization Code + PKCE exchanges codes for tokens in a POST request, keeping tokens out of URLs.

Client Credentials flow is for machine-to-machine authentication. No user interaction, just client ID and secret exchanged for an access token.

The 'sub' (subject) claim is a unique identifier for the user within that identity provider. Use this to link users to your database, not email (which can change).

PKCE requires the original code_verifier (which was never transmitted). The attacker only has the code_challenge hash. Without the verifier, token exchange fails.

Without state validation, an attacker can initiate an OAuth flow, get a callback URL, and trick a victim into clicking it. The victim's account gets linked to the attacker's external account.

Access tokens authorize API access (sent to resource servers). ID tokens contain user identity claims and are for your application only. Never send ID tokens to third-party APIs.

Short-lived tokens limit the damage window. A stolen token that expires in 1 hour is less dangerous than one valid for 30 days. Use refresh tokens for longer sessions.

Refresh tokens should be in httpOnly cookies (inaccessible to JavaScript, protecting against XSS) or stored server-side with only a session ID in the cookie.

Signature verification proves the token came from the expected issuer and wasn't tampered with. Without it, anyone could create fake ID tokens. Also check iss, aud, and exp.

Refresh token rotation detects reuse. If an old token is used, it indicates theft (the legitimate client already used it). The system should revoke all tokens and require re-authentication.

The discovery document contains authorization and token endpoints, supported scopes and claims, JWKS URI for signature verification, and other configuration. Apps can auto-configure from this.

Client-side JavaScript is visible to everyone. The client_secret would be exposed. Public clients (SPAs, mobile) should use PKCE instead of client secrets.

The 'openid' scope is required for OIDC. Without it, you're doing plain OAuth 2.0 and won't receive an ID token. Additional scopes like 'profile' and 'email' add claims to the ID token.

Authorization servers should do exact string matching on redirect_uri. Path traversal tricks like /../ should be rejected. Never use wildcards or pattern matching for redirect URIs.