I recently read Secure Your APIs: OAuth2 and JWT for Beginners by Mdu Sibisi on the JetBrains Kotlin blog, and I think it's a solid starting point if API auth has always felt like a black box.
What it covers
The tutorial opens with a primer on authentication vs authorization, the four roles in OAuth2 and how a JWT is put together (header, payload, signature). From there it builds a small document management API in Kotlin with Spring Boot that acts as a resource server. It validates RS256 signed tokens, checks scopes and uses a custom JwtAuthenticationConverter to map roles and permissions from custom claims. Endpoints are protected with @PreAuthorize instead of if checks scattered through controllers. It finishes by adding a custom JwtDecoder that enforces issuer and audience validation.
Who it's for
Backend developers who know some Kotlin and Spring but have never really understood what their security config is doing. It also shows nicely how Kotlin's safe calls, safe casts and the Elvis operator make claim extraction less fragile than the Java equivalent.
What I'm taking from it
The bit that stuck with me is checking iss and aud explicitly instead of trusting that the issuer config covers it. If you run the same API across staging and production, or have several services sharing one identity provider, that one check stops a token meant for one place from working somewhere else. I'm adding it to my list of things to verify on the APIs I work on.
The full tutorial and companion code are here: Secure Your APIs: OAuth2 and JWT for Beginners
