OAuth 2.0 authorization server
Design an OAuth 2.0 / OIDC authorization server that lets thousands of third-party apps (web, mobile, SPA, server-to-server) request scoped access to your users' data. Requirements: users grant granular consent and can revoke an app's access anytime; tokens are scoped and short-lived; and you must safely support public clients (mobile/SPA) that can't keep a secret. Walk through the flows you'd support and why, how scopes and consent are stored and enforced, and how revocation works when a user removes an app.
What a strong answer looks like
Clarify scale and constraints first. Propose a clean component breakdown, then go deep on the hard parts (data model, bottlenecks, consistency, failure modes) and name the trade-offs you are making.
Clarify4:30 left
Estimate4:30 planned
Design13:30 planned
Deep dive10:30 planned
Failure7:00 planned
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.