Stripe Identity, OAuth & Access Control interview questions

'JWTs are stateless and scale' is half an answer. The other half is what happens the day you need to log someone out right now.

The token tells you which algorithm to use and where to find the key. Believing it is how signature checks become no checks.

Liveness checks were built to catch a photo held up to a camera. Deepfakes often never go near the camera at all.

Phishing-resistant MFA is only as strong as the process that replaces it when someone loses their phone. Attackers have noticed, and so do interviewers.

A user agent string is a claim anyone can type. A signature over the request is a claim only the key holder can make. The interesting part is what that signature still does not tell the site.

Ten seconds of definition, then the part that scores: why most access bugs happen to users who logged in perfectly.

Drawing the arrows is half the answer. The other half is pinning an attack to every parameter: state, redirect URI, code, verifier, audience.

Every candidate knows OIDC is 'OAuth plus identity'. Fewer can say which token goes where, and what breaks when they swap.

Documents are shared with people, folders, teams and links. Roles alone collapse under that, and the interviewer wants to see you notice when.

Both are 'something you have'. One can be typed into a fake page in real time; the other checks which page is asking.

A service account is the easy answer and the wrong one. The interviewer wants both identities visible in every call, scoped to the task, and revocable by the user.

A 1988 bug report that describes most agent incidents. The answer that scores turns it into a design rule: authority travels with the request.

Static API keys in environment variables are the most common credential leak there is. The answer is platform-issued, short-lived, attested identity.

A valid token is not valid everywhere. The scored answer explains audience binding, why forwarding a caller's token downstream breaks it, and what MCP's authorisation rules require instead.

Most OAuth breaches come from a few well-known mistakes. The scored answer explains each attack and the specific rule that stops it, as consolidated in the 2025 OAuth security best current practice.

Two enterprise workhorses with very different designs. The scored answer explains each flow, where the trust lives, and the attacks that follow from it.

Escalation rarely needs an admin permission, just a permission that leads to one. The scored answer names the common paths, finds them as a graph, and removes the edges that matter.

A bearer token works for whoever holds it. The scored answer explains how binding a token to a key changes that, the two standard ways to do it, and the cost.

An MCP server is an API that a model drives. The scored answer treats it as an OAuth resource server, authorises every tool call against the user, and keeps upstream credentials out of the client's hands.

Machine identities outnumber people in most organisations and are reviewed far less. The scored answer finds them, gives each an owner, shrinks their power and lifetime, and watches how they are used.