#015 — OAuth 2.0 and OpenID Connect
Date: August 21, 2026 | 19:00 London / 21:00 Kyiv
Format: Guest talk · technical deep-dive · ~60–70 minutes
Guest: Oleksandr Blazheiko
YouTube: https://youtube.com/live/ZcHi3dm9tZQ
Participants
Oleksandr Blazheiko — Software Development Engineer · Fullstack
Ukraine
LinkedIn · itvibe.party
What we'll cover
Seven iterations of one question: how an app proves it acts on your behalf without ever holding your password — from "enter your Google password" (2006) to tokens that never leave the backend at all. Oleksandr Blazheiko walks through the full evolution of OAuth 2.0 and OpenID Connect.
Topics
- Password anti-pattern — why "enter your Google password" used to be normal, and why it's dangerous
- OAuth 1.0a — the first step toward delegating access without a password
- Implicit flow — why the simplification went too far (and why it's banned in OAuth 2.1)
- Authorization Code — the token only travels over the back-channel
- PKCE — how SPAs and mobile apps sign in safely without a client secret
- OpenID Connect — id_token, discovery, JWKS: an identity layer on top of OAuth
- id_token anatomy — what's actually inside the JWT and how to verify its signature
- BFF pattern and OAuth 2.1 — why tokens stay on the backend today
- Checklist: what to use in a new project right now
Key takeaways
Added after the stream.
Timecodes
Added after the stream.