The login path
First the identity store knows you. Then OAuth tells the application.
Aug 22, 2026 · 8 min · AI Security Now
People talk about "logging in with OAuth" as if it were one event. It is two.
First the identity store authenticates the person — password, MFA, a subject identifier. Then the identity provider vouches for that person to an application, using the OAuth 2.0 authorization code flow with OpenID Connect.
The walkthrough is a confidential web app: the browser never sees the client secret. A SPA would use PKCE on the same hops. Scene 01 is a first visit. Scene 02 is why the second visit skips the password.
Use the hops, or the arrow keys.
Authorization code · confidential client · OIDC
01 / 14First login
You open the application
The browser will ask the app who you are. The app will not collect a password. It will send you to an identity provider, and that provider will ask the identity store.
GET https://app.example.com/
← → step · 1 / 2 scenes · esc restart