Introducing IdentiFlows.dev: A Visual Reference for Identity Flows

Every developer who has played with OAuth 2.0 or OpenID Connect knows this moment: you need to double-check the exact sequence of a flow, and the diagram you remember seeing is scattered somewhere between a spec, a blog post, and a slide deck from a conference two years ago. The mechanism is well documented, but finding the right picture of it, at the right moment, is not.

That is the gap I built Identity Flow Diagrams to close, with Auth0 and my team backing me along the way.

What It Is

Identity Flow Diagrams is a website with one job: give developers and architects a fast, visual reference for the sequence diagrams behind common identity protocols. Each flow gets its own page with:

• A short introduction explaining what the flow is for and when to use it.
• A sequence diagram showing the full exchange between the parties involved.
• A step-by-step breakdown of what happens at each stage.

The goal is simple: be faster than digging through the spec or your own memory of a documentation page you read six months ago.

What Is There Today

The website is currently organized into four categories: User Login & SSO, Application & API Security, Security Enhancements, and Others.

Right now, that covers eight flows:

• OAuth 2.0 Authorization Code flow (and its PKCE variant).
• OpenID Connect Authorization Code flow with PKCE, the recommended login flow for most modern apps.
• OpenID Connect Implicit flow, included and explicitly marked as legacy since it is deprecated in favor of Authorization Code with PKCE, although it's still used in some contexts.
• SAML 2.0 SP-Initiated SSO, one of the most used SAML flows in the enterprise context.
• OpenID Connect Discovery, for retrieving a provider's configuration and public keys.
• DPoP-Bound Access Token Request and DPoP-Bound Access Token Usage, covering the mechanism for binding a token to a specific key pair.

While a static diagram gives you an overview of the whole flow, the interactive mode allows you to go through the flow and learn what happens at each step:

This Is an Early Release

I want to be upfront about where the project stands: this is a very first release, not a finished project. This initial flow set reflects what developers ask about most often, not everything that belongs on the website eventually. A few flows I am planning to add very soon:

• OAuth 2.0 Client Credentials flow, for machine-to-machine scenarios.
• OAuth 2.0 Device Authorization flow, for browserless and input-constrained devices.
• WebAuthn, for passwordless authentication.

There is also a longer backlog behind those, including Token Exchange, Private Key JWT authentication, and many more.

I Would Like Your Feedback

This is exactly the point in a project where feedback is most useful, before the shape of things is locked in. If you try identiflows.dev and something is unclear, missing, or just wrong, I want to hear about it. Just drop a message in the comment section below.