Coming soon — this article is being prepared. Below are its question, intended outcome, and place in the story.
The question
How can you distinguish proof of sign-in from permission to call an API?
What we will work through
Distinguish proof of sign-in from permission to call an API.
Before you begin
Previously covered: OAuth participants and delegated access; Inside a JWT: header, payload, and signature.