New 
The School Gate, the Cafeteria Pass, and Your Student ID: How AuthN, AuthZ, OAuth, and OIDC Work
AuthN is the gate, AuthZ is the door, MFA is card + PIN, OAuth is the cafeteria pass, OIDC is the pass with a verified student ID â and a JWT without scopes is a pass with no labels, so default-deny. A 13-year-old-friendly walk through the five concepts that power every login on the web.