If you’ve built a REST API with Spring Boot and Kotlin but never locked it down with tokens, JetBrains has a tutorial that’s a solid place to start: Secure Your APIs: OAuth2 and JWT for Beginners.
What it covers
The tutorial starts with the basics: the difference between authentication and authorization, the four roles in OAuth2, and how a JWT is put together. It then builds a small document management API and sets it up as a resource server that verifies RS256-signed tokens using a public key.
From there it gets more practical. It maps scopes, roles and permissions from token claims into Spring authorities, and uses @PreAuthorize with method security so access rules live in one place instead of being scattered through controller code.
Who it’s for
Developers who know some Spring or Kotlin but are new to OAuth2 and JWT. You’ll want IntelliJ IDEA, Java 17 and Gradle if you follow along.
What I’m taking from it
The section on issuer and audience validation. It’s easy to stop once you’ve confirmed a token is properly signed, but a valid token issued for a different service shouldn’t get into yours. I see this check skipped a lot in internal APIs, and it matters more now that AI agents are calling APIs with tokens on users’ behalf.
Read the full tutorial here: Secure Your APIs: OAuth2 and JWT for Beginners
