I've recently been working on a project to integrate with a 3rd party. This is normal work in software development; we constantly work to make this system talk to that system and so on. The web has made this a lot easier, as many groups are moving their APIs to a more standard kind of setup. REST is ruling the integration world right now (as far as I can tell), and I don't see that changing any time soon. Security... is a different matter. Authorization and authentication tools keep evolving, sometimes in sync with integration... and sometimes not. Spring is currently pushing out new and shiny updates to spring boot ( 2.1.0 just came out! ), but spring security has not necessarily been keeping up. This isn't unique to spring. The 3rd party integration I'm working on is still using OAuth1.0 (NOT 1.0a if I can believe the documentation). When I saw that, I am sad to say that I was not surprised. Sparing the debate of OAuth1.0a vs OAuth2....