If you’ve built a REST API with Spring Boot and Kotlin but never locked it down with tokens, JetBrains has a tutorial that’s a solid place to start: Secure Your APIs: OAuth2 and JWT for Beginners.

What it covers

The tutorial starts with the basics: the difference between authentication and authorization, the four roles in OAuth2, and how a JWT is put together. It then builds a small document management API and sets it up as a resource server that verifies RS256-signed tokens using a public key.

From there it gets more practical. It maps scopes, roles and permissions from token claims into Spring authorities, and uses @PreAuthorize with method security so access rules live in one place instead of being scattered through controller code.

Who it’s for

Developers who know some Spring or Kotlin but are new to OAuth2 and JWT. You’ll want IntelliJ IDEA, Java 17 and Gradle if you follow along.

What I’m taking from it

The section on issuer and audience validation.…