# OAuth and OpenID Connect: podcast learning path

Source: https://startwithidentity.com/podcasts/learn/oauth-oidc/

Delegated authorization and federated sign-in, from first principles to the current security best practice. 15 episodes, ordered from basics to advanced.

Read alongside: [OAuth 2.0](https://startwithidentity.com/standards/oauth-2-0/), [OAuth 2.1](https://startwithidentity.com/standards/oauth-2-1/), [OpenID Connect](https://startwithidentity.com/standards/openid-connect/), [PKCE (glossary)](https://startwithidentity.com/glossary/pkce/), [JWT (glossary)](https://startwithidentity.com/glossary/jwt/), [OAuth vs OIDC](https://startwithidentity.com/guides/fundamentals/oauth-vs-oidc/), [Listening plan: OAuth, OIDC, SAML and passkeys for beginners](https://startwithidentity.com/articles/learn-identity-podcasts-oauth-oidc-saml-passkeys/)

1. [Open Authorization In The World Of AI With Aaron Parecki](https://snyk.io/podcasts/the-secure-developer/open-authorization-in-the-world-of-ai-with-aaron-parecki/) (The Secure Developer, 2025-06-10, 36 min, learner): How OAuth evolved from 1.0 to 2.1 for delegated access, how OpenID Connect and DPoP extend it, and how OAuth applies to authorizing AI agents and MCP servers.
2. [OAuth 2.0 from Protecting APIs to Supporting Authorization & Authentication - Aaron Parecki - ASW #289](https://podcasts.apple.com/us/podcast/oauth-2-0-from-protecting-apis-to-supporting-authorization/id1338907745?i=1000660197548) (Application Security Weekly, 2024-06-25, 61 min, learner): Why OAuth 2.0 is a family of specifications rather than one spec, and why it can be hard to secure by default and to make interoperable.
3. [SE Radio 376: Justin Richer On API Security with OAuth 2](https://se-radio.net/2019/08/episode-376-justin-richer-on-api-security-with-oauth-2/) (Software Engineering Radio, 2019-08-13, 74 min, learner): The core technical features of OAuth 2.0, including token types, OpenID Connect, PKCE, JWTs, client secrets, and patterns for single-page and mobile apps.
4. [OAuth, "It's complicated." (Changelog Interviews #456)](https://changelog.com/podcast/456) (The Changelog, 2021-08-23, 70 min, practitioner): Where OAuth 2.0 gets complicated, how PKCE and browser-based app guidance address it, and what OAuth 2.1 and GNAP change.
5. [OpenID Connect with Mike Jones](https://open.spotify.com/episode/6OvmRvYYEAslOyWYKzM7EE) (Identity, Unlocked, 2021-12-20, 43 min, practitioner): The design and history of OpenID Connect from one of its specification editors, covering protocol design, developer concerns, and legal aspects.
6. [#237 - OAuth 2.0 Step Up Authentication Challenge Protocol with Vittorio Bertocci](https://creators.spotify.com/pod/profile/identity-at-the-center/episodes/237---OAuth-2-0-Step-Up-Authentication-Challenge-Protocol-with-Vittorio-Bertocci-e2a00aq) (Identity at the Center, 2023-10-09, 36 min, practitioner): What the OAuth 2.0 Step Up Authentication Challenge Protocol (RFC 9470) does, from its co-author.
7. [What's new with OAuth2.1 with Aaron Parecki](https://open.spotify.com/episode/3HTH2i81D4LjACIgdWbAWF) (Identity, Unlocked, 2020-09-27, 39 min, practitioner): Explains how OAuth 2.1 consolidates OAuth 2.0 and its later RFCs, such as PKCE and the security BCP, into one document reflecting current best practice.
8. [SE Radio 526: Brian Campbell on Proof of Possession Defenses](https://se-radio.net/2022/08/episode-526-brian-campbell-on-proof-of-possession-defenses/) (Software Engineering Radio, 2022-08-24, 54 min, architect): How proof-of-possession defends against stolen OAuth tokens, comparing OAuth mTLS and DPoP and their security versus complexity trade-offs.
9. [Nat Sakimura delves into Financial-Grade API (FAPI)](https://www.ubisecure.com/podcast/nat-sakimura-financial-grade-api-fapi/) (Let's Talk About Digital Identity, 2022-01-12, architect): Why FAPI was created, its two core traits of integrity-protected messages and sender-constrained tokens, and where open banking uses it.
10. [#222 - Identity Standards with Justin Richer of Bespoke Engineering](https://creators.spotify.com/pod/profile/identity-at-the-center/episodes/222---Identity-Standards-with-Justin-Richer-of-Bespoke-Engineering-e271lb0) (Identity at the Center, 2023-07-17, 90 min, architect): How OpenID Connect might be designed differently today and what the Grant Negotiation and Authorization Protocol (GNAP) aims to change.
11. [Delegation in a Multi-Actor World: It's Not Just OAuth Anymore](https://sphericalcowconsulting.com/2025/06/27/delegation-part-two/) (A Digital Identity Digest, 2025-06-27, 12 min, architect): Where OAuth 2.0 falls short for multi-party delegation and what OAuth Token Exchange (RFC 8693) does and does not provide.
12. [#422 - Decoded - Securing AI Agents with Standards You Already Have](https://creators.spotify.com/pod/profile/identity-at-the-center/episodes/422---Decoded---Securing-AI-Agents-with-Standards-You-Already-Have-e3j8ncb) (Identity at the Center, 2026-05-15, 78 min, architect): How existing OAuth specifications such as JWT authorization grant, token exchange, and client ID metadata, plus SPIFFE, apply to securing AI agents as workloads.
13. [#449 - Decoded - Transaction Tokens with George Fletcher](https://creators.spotify.com/pod/profile/identity-at-the-center/episodes/449---Decoded---Transaction-Tokens-with-George-Fletcher-e3ojmm9) (Identity at the Center, 2026-09-21, 71 min, architect): How OAuth Transaction Tokens secure requests across microservices, including their claims, time to live, immutability, and use with AI agents.
14. [A Lap Around the OAuth2 Security BCP with Daniel Fett](https://open.spotify.com/episode/72LBKfvwopdrbn1aInqJvt) (Identity, Unlocked, 2020-10-24, 34 min, architect): Walks through the OAuth 2.0 Security BCP and its three biggest recommendations: drop the implicit grant, use PKCE with the code flow, and sender-constrain tokens.
15. [PAR, RAR, and JAR with Filip Skokan](https://open.spotify.com/episode/5Fd3446nKjgnptRSxxYjWr) (Identity, Unlocked, 2021-02-08, 21 min, architect): Explains three OAuth extensions, Rich Authorization Requests, Pushed Authorization Requests, and JWT-Secured Authorization Requests, and which core OAuth 2.0 shortcomings each one addresses.