Authorization server
An authorization server is an OAuth component that authenticates clients or resource owners, obtains authorization, and issues credentials such as authorization codes and access tokens.
Spring in Action, Sixth Edition
An authorization server is a system that authenticates clients or resource owners and issues access tokens for authorized access to protected resources.
- How it is used
- Issues access tokens so clients can call a protected REST API on a user’s behalf.
- How deep it goes
- Works through project setup, client registration, signing keys, login, consent, and token exchange; notes that the chosen implementation remains experimental.
- Examples
- Uses an ingredient-management client, consent page, token-endpoint curl request, and Bearer-token API request.
- What you can do after
- Builds it from scratch with Spring Authorization Server and connects it to a token-verifying API and OAuth 2 client.
Read how Spring in Action, Sixth Edition explains authorization server →
Spring Security in Action, Second Edition
An authorization server is the OAuth 2 component that issues tokens after processing an authorization grant and may provide identity-provider functions in OpenID Connect.
- How it is used
- Coordinates authentication, client registration, token issuance, and access authorization between clients and resource servers.
- How deep it goes
- Descends from actor responsibilities and token flows to Spring beans, filters, signing keys, endpoint settings, introspection, and revocation.
- Examples
- Uses Mary’s invoice application, authorization-code redirects, client-credentials service calls, opaque-token introspection, and Spring Security configuration listings.
- What you can do after
- Build it from scratch with Spring Security using authorization-code and client-credentials grants, configurable token formats, and registered clients.
Read how Spring Security in Action, Second Edition explains authorization server →
Effective Platform Engineering
An authorization server is a service that issues tokens and communicates authorization information to clients or relying services.
- How it is used
- Connects platform identity to authorization data so issued tokens can support access to infrastructure and custom APIs.
- How deep it goes
- Explains the required identity-provider integration and claims behavior, then compares deployment choices without detailing authorization-server internals.
- Examples
- Uses a GitHub-backed identity flow for team-based platform access and contrasts Auth0 with Keycloak and Dex.
- What you can do after
- Operate/configure it by selecting an identity-provider integration that returns authorization claims from an authoritative team source.
Read how Effective Platform Engineering explains authorization server →
Secure APIs
An authorization server is a service that authenticates resource owners, obtains their consent, and issues authorization credentials such as authorization codes and access tokens.
- How it is used
- Coordinates OAuth identity, consent, authorization-code, access-token, PKCE, and device-authorization flows.
- How deep it goes
- Traces requests, consent, codes, tokens, PKCE parameters, and device polling, without implementing a complete server.
- Examples
- Uses a LinkedIn job-portal integration, authorization URLs, PKCE parameters, and smart-TV device authorization.
- What you can do after
- Evaluate OAuth flow choices and apply authorization-code, PKCE, or device authorization patterns to appropriate clients.
Acing the CCNA Exam: Volume 2 Advanced Networking and Security
An authorization server is a service that authenticates clients or resource owners and issues authorization credentials such as access tokens.
- How it is used
- Issues access tokens that clients use to authenticate requests to protected REST API resources.
- How deep it goes
- Explains token acquisition, limited validity, renewal, and OAuth delegation, but does not specify server configuration or token internals.
- Examples
- Uses bearer authentication and the OAuth 2.0 authorization-grant flow as concrete access-token examples.
- What you can do after
- Apply bearer authentication by obtaining, transmitting, and renewing access tokens for protected API requests.
Authorization in Action
An authorization server is an OAuth component that authenticates clients or users, obtains authorization, and issues authorization codes and tokens.
- How it is used
- Coordinates OAuth authentication, consent, and token issuance between clients and protected APIs.
- How deep it goes
- Explains OAuth roles and authorization-code steps, then extends token acquisition to client credentials.
- Examples
- Uses BI Explorer’s delegated access and CustCo’s server-to-server task integration as concrete OAuth scenarios.
- What you can do after
- Operate OAuth integrations by redirecting users, reviewing scopes, exchanging codes, and presenting tokens to APIs.
Read how Authorization in Action explains authorization server →
Related concepts
- API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
- Spring Authorization Serverimplemented by · Spring Authorization Server is a Spring project for building OAuth 2.0 and OpenID Connect authorization servers.
- openid connectimplements · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
- authorization codeproduces · An authorization code is a short-lived credential issued by an authorization server for a client to exchange for an access token.
- OAuthpart of · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.