[{"_1":2,"_46":-5,"_47":-5},"loaderData",{"_3":4,"_14":15,"_44":-5,"_45":-5},"root",{"_5":-5,"_6":-5,"_7":-5,"_8":9,"_10":11},"user","shoppingCartId","toast","locale","en","constants",{"_12":13},"paypalClientId","AenrHU49peF-ZUH-Yq7AXLLNZYGUGlml474U16NCjB4ZznmQCEjiliN3whyuVZmkb7VxEzmTALgtKEKE","routes/_store+/_readers+/email_author.$slug/route",{"_16":17,"_43":-5},"book",{"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":29},"id","Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6Qm9va1Byb2R1Y3QvNjcwODM","title","Securing Applications with OAuth2 and OpenID Connect","state","published","contactAuthorMethod","email","aboutText","

You’ve seen it everywhere: visit a site like Strava or The New York Times and the first thing you spot is a Sign Up or Subscribe button. Click it, and up pops a familiar box — enter your email or choose a shortcut like Continue with Google, Facebook, or Apple.

As a developer, you want to know what really happens when you click those buttons. How does the site know who you are? What keeps the process both secure and seamless?

Drawing on years of experience writing OAuth and OpenID Connect (OIDC) code and running the SSO system at a mid-size health accreditation company, I break down how these flows work and how you can build them yourself.

With Duende IdentityServer as the reference system, you’ll learn practical steps that carry over to other platforms, including Microsoft Entra ID. By the end, you’ll see the sign-in box not as a mystery, but as a system you can design, run, and scale.

","authors",[30],{"_18":31,"_32":33,"_5":34},"Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6UHJvZHVjdEF1dGhvci83MTExNg","name","Sangeet Agarwal",{"_35":36},"avatar",{"_37":38,"_39":40,"_41":42},"url","https://d308did4coypzi.cloudfront.net/avatars/198561/medium/2169707.png?1757869056","styleName","medium","exists",true,"currentUser","routes/_store+/_layout","routes/_store+/_readers+/_layout","actionData","errors"]

Email the Author