2 ms·

The point made, which I agree with, is that the API itself might be easy. What makes it hard is understanding the domain, the documentation, the tools and other

The point made, which I agree with, is that the API itself might be easy. What makes it hard is understanding the domain, the documentation, the tools and other bits around it. For the case of OAuth 2.0, I do really think it is an easy API to use as such. What makes OAuth 2.0 hard is exactly the other stuff mentioned above, which is compounded significantly if one uses OIDC on top of OAuth 2.0. Once you get an understanding for the domain and the technical language used, it ends up being just a few calls with some fairly straight forward data passed. As mentioned in another comment here, it can be as simple as just a single, simple POST call with a username and password to get a token, which you then pass in the usual HTTP header. How is that not easy?! This is very much unlike certain other APIs. I mentioned Vulkan in another comment as such an example, but there are many others. For example, using Vulkan you must actively take care to add fences and use semaphores to ensure ordered operations. That's on a whole other level of complexity compared to OAuth 2.0.

RHSeeger 2y ago
> What makes it hard is understanding the domain, the documentation, the tools and other bits around it. But the point is that, if you can't use the API without understanding the domain, then the API isn't easy to use. Saying that knowledge isn't _specifically_ the API (just required to use it) isn't reasonable. It would be one thing to say "this specific implementation of OAuth2 isn't hard to use" because, for a specific implementation, you'd only compare it against "the knowledge you need that's different from other implementations". But to use OAuth2 in general, you need all the "other" knowledge. Which translates to "OAuth2 is a hard/complicated API to use".
- magicalhippo 2y ago
  I get your point, and overall I agree that for someone not well versed in authentication and authorization, OAuth 2.0 certainly can be hard to get figured out. It definitely took me some time to grok. However I still think it's a distinction that's worth making, because documentation, tooling etc is something one can do something about relatively easy.

RHSeeger 2y ago

> What makes it hard is understanding the domain, the documentation, the tools and other bits around it. But the point is that, if you can't use the API without understanding the domain, then the API isn't easy to use. Saying that knowledge isn't _specifically_ the API (just required to use it) isn't reasonable. It would be one thing to say "this specific implementation of OAuth2 isn't hard to use" because, for a specific implementation, you'd only compare it against "the knowledge you need that's different from other implementations". But to use OAuth2 in general, you need all the "other" knowledge. Which translates to "OAuth2 is a hard/complicated API to use".

magicalhippo 2y ago
I get your point, and overall I agree that for someone not well versed in authentication and authorization, OAuth 2.0 certainly can be hard to get figured out. It definitely took me some time to grok. However I still think it's a distinction that's worth making, because documentation, tooling etc is something one can do something about relatively easy.