Identity flows, made visible
Find a flow by name, protocol or tag, or filter by category.
4 flows · The flows most people start with.
CIBA Backchannel Authentication
Approve a sign-in or transaction on a separate device.
OAuth Device Authorization
Sign in on input-constrained devices using a second device.
OIDC Code + PKCE
Recommended OIDC login with code and PKCE.
OIDC Implicit Flow Deprecated
Legacy browser flow with tokens in the URL fragment.
SAML SP-Initiated SSO
SP redirects to the IdP, which posts back an assertion.
CIBA Backchannel Authentication
Approve a sign-in or transaction on a separate device.
OAuth Authorization Code
Classic three-party authorization code exchange.
OAuth Code + PKCE
Authorization code exchange hardened with PKCE.
OAuth Client Credentials
Get an access token for machine-to-machine API calls.
OAuth Device Authorization
Sign in on input-constrained devices using a second device.
OAuth Private Key JWT
Authenticate a client with a signed JWT, not a secret.
OAuth Refresh Token
Renew an expired access token without user interaction.
DPoP Token Request
Bind an access token request to a key pair.
DPoP Token Usage
Call a DPoP-protected API with a bound token.
OAuth Private Key JWT
Authenticate a client with a signed JWT, not a secret.
OIDC Discovery
Fetch an OpenID Provider's configuration and keys.
