I just spent som time going through this. The relevant rfc and drafts perhaps? https://tools.ietf.org/wg/oauth/ https://tools.ietf.org/wg/oauth/ Also checkout

I just spent som time going through this. The relevant rfc and drafts perhaps? https://tools.ietf.org/wg/oauth/ https://tools.ietf.org/wg/oauth/ Also checkout OWASP https://www.owasp.org/ https://www.owasp.org/ If your implementing openid connect, use a certified lib https://openid.net/developers/certified/ https://openid.net/developers/certified/