https://www.youtube.com/watch?v=XeFqLDL4lVA

Bearer token. Access token. ID token. Session cookie. OAuth. OIDC. JWT. API key. You open the auth docs and they throw ten words at you.

It feels like ten things. It's four. Here they are.

1. Identity — who you CLAIM to be

Every auth system starts with the same question: who are you? Not yet — who do you claim to be?

That's identity. It's a claim. [email protected] . User ID 42 . service: payments . A string, a number, a subject line. The system has no reason yet to believe you, but you made the claim.

Here's the part most tutorials skip. Identity and proof are two separate things. The email address alone is not authentication. It's just what you told the server.

2. Credential — proof of the claim

A credential is proof the claim is real.…