Third-party cookies are disappearing, and many “Sign in with X” flows built on embedded IdP iframes depended on them. FedCM (Federated Credential Management) is browser’s replacement: instead of the RP embedding the IdP and reading its cookies, the browser handles the identity flow and returns an identity token.
Whether you’re building a massive SaaS platform or a niche API, OAuth is the standard for authorization. But every OAuth setup runs into the same wall eventually: registration.
Everyone mostly understands the OIDC login flow correct. It’s simple and staight-forward, you do the authorization code flow, validate the ID Token, set a session cookie, and done. Logout is where things becomes a bit complex and they usually happen silently.
This is part 2 of nuts and bolts of OAuth 2.0, continuing part 1. In this section, I’ll explore the client credentials flow for machine-to-machine communication
