Member-only story
OAuth2 Explained Like You’re Building It (Not Just Using It)
Stop memorising abstract flow diagrams. This post walks through building OAuth2 from the wire up — actual HTTP requests, token anatomy, PKCE, refresh tokens, and JWT validation in Spring Boot.
Why Most OAuth2 Explanations Fail
You can draw the OAuth2 flow diagram from memory and still have no idea why you’re getting a 401 in production. That gap — between recognising the boxes and arrows and actually understanding what’s on the wire — is where every backend developer gets stuck. Every tutorial starts with the same abstract picture: “Resource Owner,” “Authorisation Server,” “Client.” You nod along, then freeze the moment a token gets rejected for a reason the diagram never mentioned.
After 17 years of building authentication systems across banking, fintech, and e-commerce in Singapore, I’ve learned that the only way to truly understand OAuth2 is to see what’s happening on the wire. What bytes are actually being exchanged. What each token contains. Why things break.
Let’s build it from scratch.
