OAuth2 Capstone Project — Build a Complete Authorization Framework

In this tutorial, you will learn about OAuth2 Capstone Project. We cover key concepts, practical examples, and best practices to help you master this topic.

Build a complete OAuth2 system with an authorization server, protected resource servers, and clients demonstrating Authorization Code, PKCE, and Client Credentials grants.

Project Overview

Create three services: Authorization Server (issues tokens), User API Resource Server (validates tokens), and Threat API Resource Server (validates tokens). The system must support web app users (Authorization Code + PKCE) and backend services (Client Credentials).

flowchart TD
    A["Auth Server\nPort 5001"] -->|"Issues tokens"| B["User API\nPort 5002"]
    A -->|"Issues tokens"| C["Threat API\nPort 5003"]
    D["Web App Client\nAuth Code + PKCE"] --> A
    D --> B
    E["Backend Service\nClient Credentials"] --> A
    E --> C
    style A fill:#dbeafe,stroke:#2563eb
    style B fill:#dcfce7,stroke:#16a34a
    style C fill:#dcfce7,stroke:#16a34a
    style D fill:#fef3c7,stroke:#d97706
    style E fill:#fef3c7,stroke:#d97706

Requirements

1. Authorization Server

• Client registration (confidential and public)
• Authorization Code grant with PKCE support
• Client Credentials grant
• Token introspection endpoint
• Token revocation endpoint
• JWKS endpoint (for RS256 tokens)
• Refresh token with rotation

2. Resource Servers

• User API (scopes: users:read, users:write)
• Threat API (scopes: threat:read, threat:write)
• Both validate tokens via introspection or local JWT validation
• Both enforce scopes on every endpoint

3. Security Features

• HTTPS (self-signed certs for development)
• State parameter on all authorization requests
• Rate Limiting on token endpoint
• No logging of credentials or tokens
• Proper WWW-Authenticate error responses

Starter Structure

oauth-project/
├── auth_server/
│   ├── app.py
│   ├── models.py
│   └── requirements.txt
├── user_api/
│   ├── app.py
│   └── requirements.txt
├── threat_api/
│   ├── app.py
│   └── requirements.txt
├── tests/
│   └── test_all.py
└── README.md

Testing

# Test Authorization Code with PKCE
# 1. Request authorization with code_challenge
# 2. Exchange code with code_verifier
# 3. Use access token

# Test Client Credentials
# 1. Request token with client credentials
# 2. Use token for API calls

# Test scope enforcement
# 1. Get token with threat:read scope
# 2. Try to access user:write endpoint — should fail

Evaluation

FAQ

What's Next

Congratulations on completing the OAuth2 learning path! Continue to the OpenID Connect Guide for adding authentication on top of OAuth2.