Junior (1–3 years) · Module A
Authentication & OAuth2 Flows
Authorization code vs. client credentials, and where tokens actually live in a request.
What this session covers
- Authorization code flow is the standard for anything with a login screen — the token exchange happens server-to-server, never in the browser.
- Client credentials flow skips the redirect entirely — used for server-to-server integrations with no end user involved.
- Access tokens are short-lived on purpose; refresh tokens are what get stolen and misused, so they need tighter storage rules.
- PKCE closes the "stolen authorization code" gap for public clients (mobile apps, SPAs) that can't keep a secret.
What junior FDE interviews look for
Junior Forward Deployed Engineer interviews go deeper on integration fundamentals — REST API design, OAuth2, webhooks, data mapping and SQL — and add customer-facing scenarios such as running a technical discovery call or handling pushback on what your API can do.