--- title: Introducing IdentiFlows.dev: A Visual Reference for... description: Auth0 developer advocate Andrea Chiarelli introduces identiflows.dev, a free website offering visual sequence diagrams for common identity protocol flows like... canonical: https://daily.dev/posts/introducing-identiflows-dev-a-visual-reference-for-identity-flows-qcotgczbk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing IdentiFlows.dev: A Visual Reference for Identity Flows | daily.dev og:description: Auth0 developer advocate Andrea Chiarelli introduces identiflows.dev, a free website offering visual sequence diagrams for common identity protocol flows like... og:url: https://daily.dev/posts/introducing-identiflows-dev-a-visual-reference-for-identity-flows-qcotgczbk og:image: https://api.daily.dev/og/posts/qcoTgcZBk.png og:image:alt: Introducing IdentiFlows.dev: A Visual Reference for Identity Flows og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing IdentiFlows.dev: A Visual Reference for Identity Flows **[Auth0](https://daily.dev/sources/auth0)** · 3 min read · 3 upvotes · 0 comments ## Summary Auth0 developer advocate Andrea Chiarelli introduces identiflows.dev, a free website offering visual sequence diagrams for common identity protocol flows like OAuth 2.0 Authorization Code (with PKCE), OpenID Connect Authorization Code, Implicit flow, SAML 2.0 SP-Initiated SSO, OpenID Connect Discovery, and DPoP-bound token flows. Each flow includes an explanation, a diagram, and a step-by-step breakdown, with an interactive mode to walk through steps. The site currently covers eight flows across four categories and is explicitly an early release, with Client Credentials, Device Authorization, and WebAuthn flows planned next. The author is soliciting feedback from the community to shape future additions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is the OpenID Connect Implicit flow deprecated? Yes, the OpenID Connect Implicit flow is considered legacy and deprecated in favor of the Authorization Code flow with PKCE, which is now the recommended login flow for most modern applications. The Implicit flow is still documented and occasionally used in some contexts, but new applications should avoid it. _Developers auditing legacy auth flows can track OIDC and OAuth guidance changes on daily.dev._ ### What is a DPoP-bound access token and how does it differ from a regular bearer token? A DPoP-bound access token is cryptographically bound to a specific key pair, unlike a standard bearer token that anyone possessing it can use. This binding happens through a DPoP-Bound Access Token Request and is enforced during DPoP-Bound Access Token Usage, mitigating token theft and replay risks in OAuth 2.0 deployments. _Engineers securing token-based APIs can follow OAuth security mechanisms like DPoP on daily.dev._ ### What identity flow diagrams are available on identiflows.dev at launch? The initial release covers eight flows: OAuth 2.0 Authorization Code (with its PKCE variant), OpenID Connect Authorization Code with PKCE, OpenID Connect Implicit flow, SAML 2.0 SP-Initiated SSO, OpenID Connect Discovery, and DPoP-Bound Access Token Request and Usage. Each page includes an explanation, a sequence diagram, and a step-by-step breakdown, organized into four categories. _Architects comparing identity protocols can keep up with new developer reference tools on daily.dev._ ## Similar posts on daily.dev - [Optimize Identity Flows with Auth0 Identity Conversion Suite](https://daily.dev/posts/optimize-identity-flows-with-auth0-identity-conversion-suite-ssfljxafp) · Auth0 · 0 upvotes · 0 comments - [Authentication Flow Explained: Step-by-Step Login & Token Exchange Process](https://daily.dev/posts/authentication-flow-explained-step-by-step-login-token-exchange-process-jhfu1vcn7) · Security Boulevard · 2 upvotes · 0 comments - [OAuth 2.0 – Device flow explained for Engineers, especially for Backend Engineers](https://daily.dev/posts/oauth-2-0-device-flow-explained-for-engineers-especially-for-backend-engineers-dzube1gf7) · Stack Overflow Blog · 5 upvotes · 0 comments - [How to Secure APIs with OAuth 2.1 and OpenID Connect](https://daily.dev/posts/how-to-secure-apis-with-oauth-2-1-and-openid-connect-rf7g6orkv) · C\# Corner · 0 upvotes · 1 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#auth0](https://daily.dev/tags/auth0) [View this post on daily.dev](https://daily.dev/posts/introducing-identiflows-dev-a-visual-reference-for-identity-flows-qcotgczbk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing IdentiFlows.dev: A Visual Reference for Identity Flows","url":"https://daily.dev/posts/introducing-identiflows-dev-a-visual-reference-for-identity-flows-qcotgczbk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-identiflows-dev-a-visual-reference-for-identity-flows-qcotgczbk"},"datePublished":"2026-09-29T15:07:54.021Z","dateModified":"2026-09-29T19:19:48.067Z","description":"Auth0 developer advocate Andrea Chiarelli introduces identiflows.dev, a free website offering visual sequence diagrams for common identity protocol flows like...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0af3fcf1cea897080aa90057eee1eade?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0af3fcf1cea897080aa90057eee1eade?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Auth0","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Auth0","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/6510ffa7350449618fbacdddae663b82","url":"https://daily.dev/sources/auth0"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-identiflows-dev-a-visual-reference-for-identity-flows-qcotgczbk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,auth0","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Auth0","item":"https://daily.dev/sources/auth0"},{"@type":"ListItem","position":3,"name":"Introducing IdentiFlows.dev: A Visual Reference for Identity Flows"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/introducing-identiflows-dev-a-visual-reference-for-identity-flows-qcotgczbk#faq","mainEntity":[{"@type":"Question","name":"Is the OpenID Connect Implicit flow deprecated?","acceptedAnswer":{"@type":"Answer","text":"Yes, the OpenID Connect Implicit flow is considered legacy and deprecated in favor of the Authorization Code flow with PKCE, which is now the recommended login flow for most modern applications. The Implicit flow is still documented and occasionally used in some contexts, but new applications should avoid it. Developers auditing legacy auth flows can track OIDC and OAuth guidance changes on daily.dev."}},{"@type":"Question","name":"What is a DPoP-bound access token and how does it differ from a regular bearer token?","acceptedAnswer":{"@type":"Answer","text":"A DPoP-bound access token is cryptographically bound to a specific key pair, unlike a standard bearer token that anyone possessing it can use. This binding happens through a DPoP-Bound Access Token Request and is enforced during DPoP-Bound Access Token Usage, mitigating token theft and replay risks in OAuth 2.0 deployments. Engineers securing token-based APIs can follow OAuth security mechanisms like DPoP on daily.dev."}},{"@type":"Question","name":"What identity flow diagrams are available on identiflows.dev at launch?","acceptedAnswer":{"@type":"Answer","text":"The initial release covers eight flows: OAuth 2.0 Authorization Code (with its PKCE variant), OpenID Connect Authorization Code with PKCE, OpenID Connect Implicit flow, SAML 2.0 SP-Initiated SSO, OpenID Connect Discovery, and DPoP-Bound Access Token Request and Usage. Each page includes an explanation, a sequence diagram, and a step-by-step breakdown, organized into four categories. Architects comparing identity protocols can keep up with new developer reference tools on daily.dev."}}]} ```