oauth-flow-architect

Generate a code_verifier with secrets.token_urlsafe(32), derive the code_challenge via SHA256, and include it in the authorization URL. On callback, exchange the code plus the original verifier at the token endpoint to receive access and ID tokens.

Fetch the provider's signing key from its JWKS URI using PyJWKClient, then decode the JWT verifying the RS256 signature, audience, and issuer. Also check the nonce claim when one was sent in the authorization request to prevent replay attacks.

No, GitHub implements OAuth 2.0 only, not OIDC, so there is no ID token. You must call the api.github.com/user endpoint with the access token, and include an Accept: application/json header on the token exchange request.

The state parameter returned by the provider does not match the value stored in the user's session before redirect. This indicates a CSRF attempt, a lost session cookie, or a mismatched session store across servers.

Use Client Credentials for machine-to-machine authentication where no user is involved, such as backend services calling an API. It exchanges client_id and client_secret directly for an access token without any redirect or user consent.

Encrypt refresh tokens at rest using a symmetric cipher like Fernet and never log them. Rotate on each use, mark old tokens as consumed, and revoke the entire token family if a used token is presented again, which signals theft.