Clearing up (my own) OAuth misunderstandings

This article explores OAuth’s design principles, explaining why authorization and resource servers remain separate, why authorization codes exist rather than direct token issuance, and how access/refresh token pairs enhance security. The author clarifies that bearer tokens’ short lifespan mitigates leak risks, while refresh tokens require client credentials, making them unsuitable for single-page applications lacking secure backends.