Getting Started with OAuth2 and JWT in Spring Boot

I've worked with auth in my Node.js projects, so it was interesting to see how it's handled in Kotlin and Spring Boot. This tutorial starts with what OAuth2 and JWT actually do, then walks through protecting a simple document API.

It covers verifying tokens and using scopes, roles and permissions to control who can access each endpoint. If you know basic Kotlin and Spring Boot and want to add auth to your API, this is a good place to start.

One thing I'd use in my own projects is checking the token's issuer and audience along with its signature and expiry. A valid signature alone doesn't mean the token was issued for your API, which is an easy detail to miss.