Loading post…
Auth0Andrea ChiarelliAnnouncement
Introducing IdentiFlows.dev: A Visual Reference for Identity Flows
Summary
Developers often struggle to quickly find accurate sequence diagrams for OAuth 2.0 and OpenID Connect flows. IdentiFlows.dev is a new website that provides a visual reference for common identity protocols, organized into four categories. Each flow page includes an introduction explaining the flow’s purpose, a sequence diagram showing the full exchange, and a step-by-step breakdown of each stage, with an interactive mode to walk through the steps. The initial release covers eight flows, including OAuth 2.0 Authorization Code with PKCE, the recommended login flow for most modern apps, SAML 2.0 SP-Initiated SSO, DPoP-Bound Access Token requests, and OpenID Connect Discovery. The project is an early release with plans to add more flows like Client Credentials, Device Authorization, and WebAuthn, and the author invites feedback to guide development.
Context
Developers often need to double-check the exact sequence of an OAuth 2.0 or OpenID Connect flow, but the diagrams are scattered across specifications, blog posts, and conference slide decks, making them hard to find quickly.
Approach / What changed
IdentiFlows.dev is a website that provides a visual reference for identity protocol flows, with each flow page including an introduction, a sequence diagram, a step-by-step breakdown, and an interactive mode to walk through each step.
Takeaways
The initial release covers eight flows, including OAuth 2.0 Authorization Code with PKCE, SAML 2.0 SP-Initiated SSO, and DPoP-Bound Access Token requests.
The OpenID Connect Implicit flow is included but explicitly marked as legacy, deprecated in favor of Authorization Code with PKCE.
Planned future flows include Client Credentials, Device Authorization, and WebAuthn for passwordless authentication.
FAQ
What flows are currently available on IdentiFlows.dev?
The initial release covers eight flows, including OAuth 2.0 Authorization Code with PKCE, SAML 2.0 SP-Initiated SSO, DPoP-Bound Access Token requests, and OpenID Connect Discovery. The full list is organized into four categories on the website.
Is the OpenID Connect Implicit flow still recommended?
No, the Implicit flow is included but explicitly marked as legacy. It is deprecated in favor of the Authorization Code flow with PKCE, which is the recommended login flow for most modern apps.
How can I provide feedback on IdentiFlows.dev?
The author invites feedback by dropping a message in the comment section below the post. This is an early release, and feedback is most useful before the shape of things is locked in.
Source and freshness
- Source
- auth0.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.