Lesson 2: The authorization flow, from 401 to token

Module 7 · Lesson 2 · About 55 minutes · Needs: Lesson 1 of this module (the stand-in provider, auth.py, build_server with a token verifier, the 401 and discovery); Module 5 Lesson 1 (the packaged server). No model calls and no keys.

The situation

Monday 28 September 2026, week 4. Priya wants to search Nare's notes from her own computer. Lesson 1 locked the HTTP server: a request without a token gets 401 and a pointer to the server's discovery document. Priya's host has no token yet. Today you run, end to end, every step her host takes to get one: from that 401 to a token that works only at the notes server and carries only notes:read. The identity provider is a stand-in on 127.0.0.1:9000, run inside the notebook, so nothing leaves your machine. The running question is Priya's: search_notes(query="nap study participants").