Implement an OAuth 2.0 Provider
Build the server side of OAuth 2.0 — auth code flow, refresh tokens, JWT signing, the works. Hard but resume-defining.
About this project
Most engineers can consume OAuth; very few can implement the server side. This project teaches the spec deeply: authorization code flow with PKCE, refresh tokens, client credential rotation, JWT signing with key rotation, and the security details (state, nonce, CSRF protection) that get a real audit passed. This is a portfolio piece that gets senior+ interview loops.
Why build this in 2026?
Identity work is one of the few engineering specialties AI hasn't commoditised — the security details require deep judgement.
What you'll ship
- GitHub repo with full spec compliance docs
Sign up to see the full project brief
Full deliverables, success criteria, and AI Career Tutor support — free.
You'll unlock:Complete project brief, AI tutor that knows this project, and progress tracking when you start.