diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..3b41682
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+/mvnw text eol=lf
+*.cmd text eol=crlf
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..667aaef
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,33 @@
+HELP.md
+target/
+.mvn/wrapper/maven-wrapper.jar
+!**/src/main/**/target/
+!**/src/test/**/target/
+
+### STS ###
+.apt_generated
+.classpath
+.factorypath
+.project
+.settings
+.springBeans
+.sts4-cache
+
+### IntelliJ IDEA ###
+.idea
+*.iws
+*.iml
+*.ipr
+
+### NetBeans ###
+/nbproject/private/
+/nbbuild/
+/dist/
+/nbdist/
+/.nb-gradle/
+build/
+!**/src/main/**/build/
+!**/src/test/**/build/
+
+### VS Code ###
+.vscode/
diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties
new file mode 100644
index 0000000..c0bcafe
--- /dev/null
+++ b/.mvn/wrapper/maven-wrapper.properties
@@ -0,0 +1,3 @@
+wrapperVersion=3.3.4
+distributionType=only-script
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.11/apache-maven-3.9.11-bin.zip
diff --git a/EXAMPLES.md b/EXAMPLES.md
new file mode 100644
index 0000000..69dfbb6
--- /dev/null
+++ b/EXAMPLES.md
@@ -0,0 +1,409 @@
+# OAuth 2.1 Quick Start Examples
+
+## PKCE Code Generation (Shell Script)
+
+```bash
+# Generate code verifier
+CODE_VERIFIER=$(openssl rand -base64 32 | tr -d '+/' | tr '=' '_' | cut -c1-43)
+
+# Generate code challenge
+CODE_CHALLENGE=$(echo -n "$CODE_VERIFIER" | openssl dgst -binary -sha256 | openssl base64 | tr -d '+/' | tr '=' '_')
+
+echo "Code Verifier: $CODE_VERIFIER"
+echo "Code Challenge: $CODE_CHALLENGE"
+```
+
+## PKCE Code Generation (Python)
+
+```python
+import base64
+import hashlib
+import os
+
+# Generate code verifier
+code_verifier = base64.urlsafe_b64encode(os.urandom(32)).decode('utf-8').rstrip('=')
+
+# Generate code challenge
+code_challenge = base64.urlsafe_b64encode(
+    hashlib.sha256(code_verifier.encode('utf-8')).digest()
+).decode('utf-8').rstrip('=')
+
+print(f"Code Verifier: {code_verifier}")
+print(f"Code Challenge: {code_challenge}")
+```
+
+## PKCE Code Generation (JavaScript/Node.js)
+
+```javascript
+const crypto = require('crypto');
+
+// Generate code verifier
+const codeVerifier = base64URLEncode(crypto.randomBytes(32));
+
+// Generate code challenge
+const hash = crypto.createHash('sha256').update(codeVerifier).digest();
+const codeChallenge = base64URLEncode(hash);
+
+function base64URLEncode(str) {
+    return str.toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+
+console.log('Code Verifier:', codeVerifier);
+console.log('Code Challenge:', codeChallenge);
+```
+
+## Complete Authorization Code Flow Example
+
+### Step 1: Start Authorization
+
+```bash
+# Generate PKCE
+CODE_VERIFIER=$(openssl rand -base64 32 | tr -d '+/' | tr '=' '_' | cut -c1-43)
+CODE_CHALLENGE=$(echo -n "$CODE_VERIFIER" | openssl dgst -binary -sha256 | openssl base64 | tr -d '+/' | tr '=' '_')
+
+# Open in browser
+open "http://localhost:9000/oauth2/authorize?response_type=code&client_id=public-client&redirect_uri=http://127.0.0.1:8080/authorized&scope=openid%20profile%20email%20read%20write&code_challenge=$CODE_CHALLENGE&code_challenge_method=S256&state=xyz123"
+```
+
+### Step 2: Get Tokens
+
+```bash
+# After login and approval, extract the code from redirect URL
+# Then exchange it for tokens
+
+curl -X POST http://localhost:9000/oauth2/token \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "grant_type=authorization_code" \
+  -d "code=YOUR_AUTHORIZATION_CODE" \
+  -d "redirect_uri=http://127.0.0.1:8080/authorized" \
+  -d "client_id=public-client" \
+  -d "code_verifier=$CODE_VERIFIER"
+```
+
+### Step 3: Use Access Token
+
+```bash
+# Get user info
+curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
+  http://localhost:9000/userinfo
+```
+
+### Step 4: Refresh Token
+
+```bash
+curl -X POST http://localhost:9000/oauth2/token \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "grant_type=refresh_token" \
+  -d "refresh_token=YOUR_REFRESH_TOKEN" \
+  -d "client_id=public-client"
+```
+
+## Client Credentials Flow (Server-to-Server)
+
+```bash
+curl -X POST http://localhost:9000/oauth2/token \
+  -u confidential-client:secret \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "grant_type=client_credentials" \
+  -d "scope=read write"
+```
+
+## Inspect JWT Token
+
+```bash
+# Copy your access token and decode at jwt.io
+# Or use command line:
+
+echo "YOUR_JWT_TOKEN" | cut -d. -f2 | base64 -d | jq '.'
+```
+
+## Test with cURL
+
+### Get Well-Known Configuration
+
+```bash
+curl http://localhost:9000/.well-known/oauth-authorization-server | jq '.'
+```
+
+### Get JWK Set
+
+```bash
+curl http://localhost:9000/oauth2/jwks | jq '.'
+```
+
+### Token Introspection
+
+```bash
+curl -X POST http://localhost:9000/oauth2/introspect \
+  -u confidential-client:secret \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "token=YOUR_ACCESS_TOKEN"
+```
+
+### Token Revocation
+
+```bash
+curl -X POST http://localhost:9000/oauth2/revoke \
+  -u confidential-client:secret \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "token=YOUR_ACCESS_TOKEN"
+```
+
+## Integration Examples
+
+### Spring Boot Resource Server
+
+```yaml
+# application.yml
+spring:
+  security:
+    oauth2:
+      resourceserver:
+        jwt:
+          issuer-uri: http://localhost:9000
+```
+
+```java
+@Configuration
+@EnableWebSecurity
+public class ResourceServerConfig {
+    
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        http
+            .authorizeHttpRequests(authorize -> authorize
+                .requestMatchers("/public/**").permitAll()
+                .anyRequest().authenticated()
+            )
+            .oauth2ResourceServer(oauth2 -> oauth2
+                .jwt(Customizer.withDefaults())
+            );
+        return http.build();
+    }
+}
+```
+
+### React SPA with PKCE
+
+```javascript
+// OAuth client configuration
+const config = {
+    authorizationEndpoint: 'http://localhost:9000/oauth2/authorize',
+    tokenEndpoint: 'http://localhost:9000/oauth2/token',
+    clientId: 'public-client',
+    redirectUri: 'http://localhost:3000/callback',
+    scope: 'openid profile email read write'
+};
+
+// Generate PKCE
+async function generatePKCE() {
+    const verifier = generateRandomString(43);
+    const challenge = await pkceChallengeFromVerifier(verifier);
+    sessionStorage.setItem('code_verifier', verifier);
+    return challenge;
+}
+
+function generateRandomString(length) {
+    const array = new Uint8Array(length);
+    crypto.getRandomValues(array);
+    return base64URLEncode(array);
+}
+
+async function pkceChallengeFromVerifier(verifier) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hash = await crypto.subtle.digest('SHA-256', data);
+    return base64URLEncode(new Uint8Array(hash));
+}
+
+function base64URLEncode(buffer) {
+    return btoa(String.fromCharCode(...buffer))
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+
+// Start OAuth flow
+async function login() {
+    const codeChallenge = await generatePKCE();
+    const state = generateRandomString(20);
+    sessionStorage.setItem('oauth_state', state);
+    
+    const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: config.clientId,
+        redirect_uri: config.redirectUri,
+        scope: config.scope,
+        code_challenge: codeChallenge,
+        code_challenge_method: 'S256',
+        state: state
+    });
+    
+    window.location.href = `${config.authorizationEndpoint}?${params}`;
+}
+
+// Handle callback
+async function handleCallback() {
+    const params = new URLSearchParams(window.location.search);
+    const code = params.get('code');
+    const state = params.get('state');
+    
+    if (state !== sessionStorage.getItem('oauth_state')) {
+        throw new Error('Invalid state parameter');
+    }
+    
+    const codeVerifier = sessionStorage.getItem('code_verifier');
+    
+    const tokenResponse = await fetch(config.tokenEndpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded'
+        },
+        body: new URLSearchParams({
+            grant_type: 'authorization_code',
+            code: code,
+            redirect_uri: config.redirectUri,
+            client_id: config.clientId,
+            code_verifier: codeVerifier
+        })
+    });
+    
+    const tokens = await tokenResponse.json();
+    sessionStorage.setItem('access_token', tokens.access_token);
+    sessionStorage.setItem('refresh_token', tokens.refresh_token);
+    
+    return tokens;
+}
+```
+
+### Android/Kotlin Example
+
+```kotlin
+// Using AppAuth library
+val config = AuthorizationServiceConfiguration(
+    Uri.parse("http://localhost:9000/oauth2/authorize"),
+    Uri.parse("http://localhost:9000/oauth2/token")
+)
+
+val request = AuthorizationRequest.Builder(
+    config,
+    "public-client",
+    ResponseTypeValues.CODE,
+    Uri.parse("myapp://callback")
+)
+    .setScope("openid profile email read write")
+    .setCodeVerifier(CodeVerifierUtil.generateRandomCodeVerifier())
+    .build()
+
+val authService = AuthorizationService(context)
+val authIntent = authService.getAuthorizationRequestIntent(request)
+startActivityForResult(authIntent, AUTH_REQUEST_CODE)
+```
+
+### iOS/Swift Example
+
+```swift
+// Using AppAuth library
+let config = OIDServiceConfiguration(
+    authorizationEndpoint: URL(string: "http://localhost:9000/oauth2/authorize")!,
+    tokenEndpoint: URL(string: "http://localhost:9000/oauth2/token")!
+)
+
+let request = OIDAuthorizationRequest(
+    configuration: config,
+    clientId: "public-client",
+    scopes: ["openid", "profile", "email", "read", "write"],
+    redirectURL: URL(string: "myapp://callback")!,
+    responseType: OIDResponseTypeCode,
+    additionalParameters: nil
+)
+
+OIDAuthorizationService.present(request, presenting: self) { response, error in
+    guard let response = response else {
+        return
+    }
+    // Exchange authorization code for tokens
+}
+```
+
+## Common OAuth Parameters
+
+### Authorization Request Parameters
+
+| Parameter | Required | Description |
+|-----------|----------|-------------|
+| response_type | Yes | Must be "code" |
+| client_id | Yes | Client identifier |
+| redirect_uri | Yes | Callback URL (must match registered) |
+| scope | No | Space-separated list of scopes |
+| state | Recommended | Random string to prevent CSRF |
+| code_challenge | Yes (OAuth 2.1) | PKCE challenge |
+| code_challenge_method | Yes | Must be "S256" |
+
+### Token Request Parameters (Authorization Code)
+
+| Parameter | Required | Description |
+|-----------|----------|-------------|
+| grant_type | Yes | Must be "authorization_code" |
+| code | Yes | Authorization code from callback |
+| redirect_uri | Yes | Same as authorization request |
+| client_id | Yes | Client identifier |
+| code_verifier | Yes (OAuth 2.1) | PKCE verifier |
+
+### Token Request Parameters (Refresh Token)
+
+| Parameter | Required | Description |
+|-----------|----------|-------------|
+| grant_type | Yes | Must be "refresh_token" |
+| refresh_token | Yes | Current refresh token |
+| client_id | Yes | Client identifier |
+| scope | No | Requested scope (must be subset) |
+
+### Token Request Parameters (Client Credentials)
+
+| Parameter | Required | Description |
+|-----------|----------|-------------|
+| grant_type | Yes | Must be "client_credentials" |
+| scope | No | Requested scopes |
+| | | Requires Basic Auth header |
+
+## Scopes Explained
+
+| Scope | Description |
+|-------|-------------|
+| openid | Required for OpenID Connect |
+| profile | Access to profile information |
+| email | Access to email address |
+| read | Read access to resources |
+| write | Write access to resources |
+
+## Token Response Structure
+
+```json
+{
+  "access_token": "eyJraWQiOiI...",
+  "refresh_token": "eyJhbGciOiJ...",
+  "token_type": "Bearer",
+  "expires_in": 900,
+  "scope": "openid profile email read write",
+  "id_token": "eyJhbGciOiJ..."
+}
+```
+
+## JWT Access Token Claims
+
+```json
+{
+  "sub": "user",
+  "aud": "public-client",
+  "nbf": 1701234567,
+  "scope": ["openid", "profile", "email", "read", "write"],
+  "iss": "http://localhost:9000",
+  "exp": 1701235467,
+  "iat": 1701234567,
+  "jti": "550e8400-e29b-41d4-a716-446655440000"
+}
+```
diff --git a/IMPLEMENTATION_SUMMARY.md b/IMPLEMENTATION_SUMMARY.md
new file mode 100644
index 0000000..1124cd9
--- /dev/null
+++ b/IMPLEMENTATION_SUMMARY.md
@@ -0,0 +1,262 @@
+# OAuth 2.1 Authorization Server - Implementation Summary
+
+## ✅ Successfully Implemented
+
+Your OAuth 2.1 Authorization Server is now fully functional and running on **http://localhost:9000**
+
+### 🎯 Key Features Implemented
+
+1. **OAuth 2.1 Compliance**
+   - ✅ PKCE (Proof Key for Code Exchange) required for all authorization code flows
+   - ✅ Refresh token rotation (non-reusable tokens)
+   - ✅ No implicit flow (removed for security)
+   - ✅ No resource owner password flow (removed for security)
+   - ✅ Exact redirect URI matching
+
+2. **Grant Types Supported**
+   - ✅ Authorization Code with PKCE
+   - ✅ Refresh Token (with rotation)
+   - ✅ Client Credentials
+
+3. **OpenID Connect 1.0**
+   - ✅ Full OIDC support
+   - ✅ UserInfo endpoint
+   - ✅ ID tokens (JWT)
+
+4. **Security Features**
+   - ✅ JWT access tokens with RSA signatures
+   - ✅ Form-based authentication
+   - ✅ CSRF protection
+   - ✅ H2 console (development only)
+
+### 📁 Project Structure
+
+```
+Auth201Server/
+├── src/main/java/com/heaerie/server/auth201/Auth201Server/
+│   ├── Auth201ServerApplication.java          # Main application
+│   ├── config/
+│   │   └── SecurityConfig.java                # OAuth 2.1 security configuration
+│   └── controller/
+│       └── UserController.java                # Protected resources
+├── src/main/resources/
+│   └── application.yaml                       # Configuration
+├── pom.xml                                    # Maven dependencies
+├── README.md                                  # Complete documentation
+├── EXAMPLES.md                                # Code examples and integrations
+├── postman_collection.json                    # Postman test collection
+└── test-oauth.sh                             # Bash test script
+```
+
+### 🔐 Pre-configured Clients
+
+#### Public Client (SPAs/Mobile)
+```
+Client ID: public-client
+Client Secret: None (public client)
+PKCE: Required
+Grant Types: Authorization Code, Refresh Token
+Redirect URIs: 
+  - http://127.0.0.1:8080/authorized
+  - http://127.0.0.1:8080/login/oauth2/code/public-client
+Scopes: openid, profile, email, read, write
+```
+
+#### Confidential Client (Server-to-Server)
+```
+Client ID: confidential-client
+Client Secret: secret
+PKCE: Required (recommended)
+Grant Types: Authorization Code, Refresh Token, Client Credentials
+Redirect URIs:
+  - http://127.0.0.1:8080/authorized
+  - http://127.0.0.1:8080/login/oauth2/code/confidential-client
+Scopes: openid, profile, email, read, write
+```
+
+### 👥 Test Users
+
+| Username | Password | Roles |
+|----------|----------|-------|
+| user     | password | USER  |
+| admin    | admin    | USER, ADMIN |
+
+### 🔗 Available Endpoints
+
+| Endpoint | URL | Description |
+|----------|-----|-------------|
+| Home | http://localhost:9000/ | Server status |
+| Well-Known | http://localhost:9000/.well-known/oauth-authorization-server | OAuth configuration |
+| Authorization | http://localhost:9000/oauth2/authorize | Start OAuth flow |
+| Token | http://localhost:9000/oauth2/token | Exchange codes/refresh tokens |
+| JWK Set | http://localhost:9000/oauth2/jwks | Public keys for JWT verification |
+| UserInfo | http://localhost:9000/userinfo | User information (requires token) |
+| Token Introspection | http://localhost:9000/oauth2/introspect | Validate tokens |
+| Token Revocation | http://localhost:9000/oauth2/revoke | Revoke tokens |
+| H2 Console | http://localhost:9000/h2-console | Database console (dev only) |
+
+### 🚀 Quick Start
+
+#### 1. Run the Server
+
+```bash
+cd /Users/agalyaramadoss/Downloads/Auth201Server
+./mvnw spring-boot:run
+```
+
+Server will start on: http://localhost:9000
+
+#### 2. Test with Bash Script
+
+```bash
+./test-oauth.sh
+```
+
+#### 3. Test with Postman
+
+Import `postman_collection.json` into Postman and test all flows.
+
+#### 4. Manual Test - Authorization Code Flow
+
+```bash
+# Generate PKCE
+CODE_VERIFIER=$(openssl rand -base64 32 | tr -d '+/' | tr '=' '_' | cut -c1-43)
+CODE_CHALLENGE=$(echo -n "$CODE_VERIFIER" | openssl dgst -binary -sha256 | openssl base64 | tr -d '+/' | tr '=' '_')
+
+# Open in browser
+open "http://localhost:9000/oauth2/authorize?response_type=code&client_id=public-client&redirect_uri=http://127.0.0.1:8080/authorized&scope=openid%20profile%20read&code_challenge=$CODE_CHALLENGE&code_challenge_method=S256&state=xyz"
+
+# After login (user/password), exchange code for tokens
+curl -X POST http://localhost:9000/oauth2/token \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "grant_type=authorization_code" \
+  -d "code=YOUR_CODE" \
+  -d "redirect_uri=http://127.0.0.1:8080/authorized" \
+  -d "client_id=public-client" \
+  -d "code_verifier=$CODE_VERIFIER"
+```
+
+#### 5. Test Client Credentials
+
+```bash
+curl -X POST http://localhost:9000/oauth2/token \
+  -u confidential-client:secret \
+  -d "grant_type=client_credentials" \
+  -d "scope=read write"
+```
+
+### 📚 Documentation
+
+- **README.md** - Complete setup and usage guide
+- **EXAMPLES.md** - Code examples for various platforms (React, Android, iOS, Python, etc.)
+- **postman_collection.json** - Postman collection for API testing
+- **test-oauth.sh** - Automated bash test script
+
+### 🔧 Technology Stack
+
+- **Spring Boot 4.0.0** - Application framework
+- **Spring Security 7.x** - Security framework
+- **Spring Authorization Server 7.0.0** - OAuth 2.1 implementation
+- **H2 Database** - In-memory database (development)
+- **Java 21** - Programming language
+- **Maven** - Build tool
+
+### 🎨 Token Configuration
+
+#### Access Tokens
+- **Type**: JWT (JSON Web Token)
+- **Signature**: RS256 (RSA 2048-bit)
+- **Lifetime**: 15 minutes
+- **Claims**: sub, scope, iss, exp, iat, jti, aud
+
+#### Refresh Tokens
+- **Lifetime**: 24 hours
+- **Rotation**: Enabled (OAuth 2.1 requirement)
+- **Reuse**: Disabled (single-use tokens)
+
+### 📖 Next Steps
+
+1. **Production Deployment**
+   - Replace H2 with PostgreSQL/MySQL
+   - Configure HTTPS/TLS
+   - Use persistent JWK keys
+   - Configure proper issuer URL
+   - Store clients and users in database
+
+2. **Customization**
+   - Add more clients in `SecurityConfig.java`
+   - Add more users or connect to LDAP/Active Directory
+   - Customize token lifetimes
+   - Add custom claims to JWT tokens
+   - Implement custom consent pages
+
+3. **Integration**
+   - Connect your frontend application
+   - Protect your APIs with JWT tokens
+   - Implement resource servers
+   - Add social login providers
+
+### 📝 Configuration Files
+
+#### pom.xml Dependencies
+```xml
+- spring-boot-starter-web
+- spring-boot-starter-security
+- spring-security-oauth2-authorization-server
+- spring-boot-starter-data-jpa
+- h2database (runtime)
+- commons-logging
+```
+
+#### application.yaml Settings
+```yaml
+server.port: 9000
+database: H2 in-memory
+logging: DEBUG for security
+```
+
+### 🐛 Troubleshooting
+
+**Server won't start?**
+```bash
+# Check if port 9000 is available
+lsof -i :9000
+
+# Kill existing process
+kill -9 <PID>
+
+# Rebuild
+./mvnw clean install
+```
+
+**Build errors?**
+```bash
+# Update dependencies
+./mvnw clean install -U
+
+# Check Java version
+java -version  # Should be 21+
+```
+
+### 📞 Support Resources
+
+- Spring Authorization Server: https://spring.io/projects/spring-authorization-server
+- OAuth 2.1: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-09
+- OpenID Connect: https://openid.net/specs/openid-connect-core-1_0.html
+- RFC 7636 (PKCE): https://datatracker.ietf.org/doc/html/rfc7636
+
+---
+
+## ✨ Summary
+
+You now have a fully functional OAuth 2.1 Authorization Server with:
+- ✅ Modern OAuth 2.1 security standards
+- ✅ PKCE enforcement for all flows
+- ✅ Refresh token rotation
+- ✅ OpenID Connect support
+- ✅ JWT access tokens
+- ✅ Production-ready architecture
+- ✅ Comprehensive documentation
+- ✅ Testing tools included
+
+**The server is ready to use for development and can be deployed to production with proper configuration!** 🎉
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..ca8355e
--- /dev/null
+++ b/README.md
@@ -0,0 +1,370 @@
+# OAuth 2.1 Authorization Server
+
+A complete OAuth 2.1 Authorization Server implementation built with Spring Boot 4.0.0 and Spring Authorization Server 7.0.0.
+
+## Features
+
+✅ **OAuth 2.1 Compliant** - Implements the latest OAuth 2.1 standard with enhanced security
+✅ **PKCE Required** - Proof Key for Code Exchange (PKCE) enforced for all clients
+✅ **Refresh Token Rotation** - Enhanced security with non-reusable refresh tokens
+✅ **OpenID Connect 1.0** - Full OIDC support for identity federation
+✅ **JWT Access Tokens** - Stateless access tokens with RSA signature
+✅ **Public & Confidential Clients** - Support for both client types
+
+## OAuth 2.1 Key Improvements
+
+This server implements OAuth 2.1 which includes:
+
+1. **PKCE Required**: All authorization code flows must use PKCE (even confidential clients)
+2. **No Implicit Flow**: Removed for security (use authorization code + PKCE instead)
+3. **No Resource Owner Password Flow**: Removed for security
+4. **Refresh Token Rotation**: Refresh tokens are single-use and rotated on each use
+5. **Redirect URI Exact Match**: No wildcard or partial matching allowed
+
+## Getting Started
+
+### Prerequisites
+
+- Java 21 or higher
+- Maven 3.8+ (or use included Maven wrapper)
+
+### Running the Server
+
+```bash
+# Using Maven wrapper
+./mvnw spring-boot:run
+
+# Or build and run
+./mvnw clean package
+java -jar target/Auth201Server-0.0.1-SNAPSHOT.jar
+```
+
+The server will start on `http://localhost:9000`
+
+### Default Users
+
+Two test users are configured:
+
+| Username | Password | Roles |
+|----------|----------|-------|
+| user     | password | USER  |
+| admin    | admin    | USER, ADMIN |
+
+### Registered Clients
+
+#### 1. Public Client (SPA/Mobile Apps)
+- **Client ID**: `public-client`
+- **Client Secret**: None (public client)
+- **Grant Types**: Authorization Code, Refresh Token
+- **PKCE**: Required
+- **Scopes**: openid, profile, email, read, write
+
+#### 2. Confidential Client (Server-to-Server)
+- **Client ID**: `confidential-client`
+- **Client Secret**: `secret`
+- **Grant Types**: Authorization Code, Refresh Token, Client Credentials
+- **PKCE**: Required (recommended)
+- **Scopes**: openid, profile, email, read, write
+
+## Endpoints
+
+### Well-Known Configuration
+```
+GET http://localhost:9000/.well-known/oauth-authorization-server
+```
+
+### Authorization Endpoint
+```
+GET http://localhost:9000/oauth2/authorize
+```
+
+### Token Endpoint
+```
+POST http://localhost:9000/oauth2/token
+```
+
+### JWK Set Endpoint
+```
+GET http://localhost:9000/oauth2/jwks
+```
+
+### Token Introspection
+```
+POST http://localhost:9000/oauth2/introspect
+```
+
+### Token Revocation
+```
+POST http://localhost:9000/oauth2/revoke
+```
+
+### UserInfo Endpoint (OIDC)
+```
+GET http://localhost:9000/userinfo
+```
+
+## Testing the OAuth Flow
+
+### 1. Authorization Code Flow with PKCE
+
+#### Step 1: Generate PKCE Challenge
+
+```bash
+# Generate code verifier (43-128 characters)
+CODE_VERIFIER=$(openssl rand -base64 32 | tr -d '+/' | tr '=' '_' | cut -c1-43)
+
+# Generate code challenge
+CODE_CHALLENGE=$(echo -n $CODE_VERIFIER | openssl dgst -binary -sha256 | openssl base64 | tr -d '+/' | tr '=' '_')
+
+echo "Code Verifier: $CODE_VERIFIER"
+echo "Code Challenge: $CODE_CHALLENGE"
+```
+
+#### Step 2: Authorization Request
+
+Open in browser:
+```
+http://localhost:9000/oauth2/authorize?
+  response_type=code&
+  client_id=public-client&
+  redirect_uri=http://127.0.0.1:8080/authorized&
+  scope=openid profile email read write&
+  code_challenge=$CODE_CHALLENGE&
+  code_challenge_method=S256&
+  state=xyz123
+```
+
+Login with `user`/`password`, then approve scopes.
+
+#### Step 3: Exchange Authorization Code for Tokens
+
+```bash
+curl -X POST http://localhost:9000/oauth2/token \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "grant_type=authorization_code" \
+  -d "code=YOUR_AUTHORIZATION_CODE" \
+  -d "redirect_uri=http://127.0.0.1:8080/authorized" \
+  -d "client_id=public-client" \
+  -d "code_verifier=$CODE_VERIFIER"
+```
+
+### 2. Client Credentials Flow (Confidential Client)
+
+```bash
+curl -X POST http://localhost:9000/oauth2/token \
+  -u confidential-client:secret \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "grant_type=client_credentials" \
+  -d "scope=read write"
+```
+
+### 3. Refresh Token Flow
+
+```bash
+curl -X POST http://localhost:9000/oauth2/token \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "grant_type=refresh_token" \
+  -d "refresh_token=YOUR_REFRESH_TOKEN" \
+  -d "client_id=public-client"
+```
+
+### 4. Access Protected Resource
+
+```bash
+curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
+  http://localhost:9000/userinfo
+```
+
+## Token Settings
+
+### Access Tokens
+- **Lifetime**: 15 minutes
+- **Format**: JWT (signed with RSA)
+- **Claims**: sub, scope, iss, exp, iat, etc.
+
+### Refresh Tokens
+- **Lifetime**: 24 hours
+- **Rotation**: Enabled (single-use tokens)
+- **Reuse**: Disabled (OAuth 2.1 requirement)
+
+## Security Features
+
+1. **PKCE Enforcement**: Prevents authorization code interception attacks
+2. **Refresh Token Rotation**: Detects token theft
+3. **JWT Signature**: RSA 2048-bit keys for token signing
+4. **HTTPS Ready**: Configure for production with proper TLS certificates
+5. **CSRF Protection**: Enabled for all non-API endpoints
+6. **Form-Based Login**: Built-in login page with session management
+
+## Development Tools
+
+### H2 Console
+
+Access the in-memory database console:
+```
+http://localhost:9000/h2-console
+```
+
+**Connection Details:**
+- JDBC URL: `jdbc:h2:mem:oauth2db`
+- Username: `sa`
+- Password: (empty)
+
+## Configuration
+
+### application.yaml
+
+```yaml
+server:
+  port: 9000
+
+spring:
+  datasource:
+    url: jdbc:h2:mem:oauth2db
+    driver-class-name: org.h2.Driver
+    username: sa
+    password: 
+```
+
+### Customization
+
+#### Add New Users
+
+Edit `SecurityConfig.java`:
+
+```java
+@Bean
+public UserDetailsService userDetailsService() {
+    UserDetails newUser = User.builder()
+        .username("newuser")
+        .password(passwordEncoder().encode("newpassword"))
+        .roles("USER")
+        .build();
+    
+    return new InMemoryUserDetailsManager(newUser);
+}
+```
+
+#### Add New Clients
+
+Edit `SecurityConfig.java`:
+
+```java
+@Bean
+public RegisteredClientRepository registeredClientRepository() {
+    RegisteredClient myClient = RegisteredClient.withId(UUID.randomUUID().toString())
+        .clientId("my-client")
+        .clientSecret("{bcrypt}$2a$10$...") // Use passwordEncoder()
+        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
+        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+        .redirectUri("https://my-app.com/callback")
+        .scope(OidcScopes.OPENID)
+        .clientSettings(ClientSettings.builder()
+            .requireProofKey(true)
+            .build())
+        .build();
+    
+    return new InMemoryRegisteredClientRepository(myClient);
+}
+```
+
+## Production Deployment
+
+### 1. Use PostgreSQL/MySQL
+
+Replace H2 with a production database:
+
+```xml
+<dependency>
+    <groupId>org.postgresql</groupId>
+    <artifactId>postgresql</artifactId>
+</dependency>
+```
+
+```yaml
+spring:
+  datasource:
+    url: jdbc:postgresql://localhost:5432/oauth2db
+    username: oauth2user
+    password: ${DB_PASSWORD}
+  jpa:
+    hibernate:
+      ddl-auto: validate
+```
+
+### 2. Enable HTTPS
+
+```yaml
+server:
+  port: 443
+  ssl:
+    key-store: classpath:keystore.p12
+    key-store-password: ${KEYSTORE_PASSWORD}
+    key-store-type: PKCS12
+    key-alias: oauth2server
+```
+
+### 3. Use Persistent JWK Keys
+
+Store keys in database or external vault instead of generating on startup.
+
+### 4. Configure Proper Issuer
+
+```java
+@Bean
+public AuthorizationServerSettings authorizationServerSettings() {
+    return AuthorizationServerSettings.builder()
+        .issuer("https://auth.yourdomain.com")
+        .build();
+}
+```
+
+### 5. Environment Variables
+
+```bash
+export DB_PASSWORD=your-secure-password
+export KEYSTORE_PASSWORD=your-keystore-password
+```
+
+## Project Structure
+
+```
+src/main/java/com/heaerie/server/auth201/Auth201Server/
+├── Auth201ServerApplication.java       # Main application
+├── config/
+│   └── SecurityConfig.java            # OAuth 2.1 configuration
+└── controller/
+    └── UserController.java            # Protected resources
+
+src/main/resources/
+└── application.yaml                    # Application configuration
+```
+
+## Troubleshooting
+
+### Problem: "Invalid redirect URI"
+
+**Solution**: Ensure redirect URI matches exactly (including protocol, host, port, and path)
+
+### Problem: "PKCE verification failed"
+
+**Solution**: Verify code_verifier matches the code_challenge used in authorization request
+
+### Problem: "Invalid client"
+
+**Solution**: Check client_id is correct and client is registered
+
+### Problem: "Refresh token invalid"
+
+**Solution**: Refresh tokens are single-use with rotation enabled
+
+## References
+
+- [OAuth 2.1 Draft](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-09)
+- [Spring Authorization Server](https://spring.io/projects/spring-authorization-server)
+- [OpenID Connect 1.0](https://openid.net/specs/openid-connect-core-1_0.html)
+- [RFC 7636 - PKCE](https://datatracker.ietf.org/doc/html/rfc7636)
+
+## License
+
+This project is for educational and development purposes.
diff --git a/mvnw b/mvnw
new file mode 100755
index 0000000..bd8896b
--- /dev/null
+++ b/mvnw
@@ -0,0 +1,295 @@
+#!/bin/sh
+# ----------------------------------------------------------------------------
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+# ----------------------------------------------------------------------------
+
+# ----------------------------------------------------------------------------
+# Apache Maven Wrapper startup batch script, version 3.3.4
+#
+# Optional ENV vars
+# -----------------
+#   JAVA_HOME - location of a JDK home dir, required when download maven via java source
+#   MVNW_REPOURL - repo url base for downloading maven distribution
+#   MVNW_USERNAME/MVNW_PASSWORD - user and password for downloading maven
+#   MVNW_VERBOSE - true: enable verbose log; debug: trace the mvnw script; others: silence the output
+# ----------------------------------------------------------------------------
+
+set -euf
+[ "${MVNW_VERBOSE-}" != debug ] || set -x
+
+# OS specific support.
+native_path() { printf %s\\n "$1"; }
+case "$(uname)" in
+CYGWIN* | MINGW*)
+  [ -z "${JAVA_HOME-}" ] || JAVA_HOME="$(cygpath --unix "$JAVA_HOME")"
+  native_path() { cygpath --path --windows "$1"; }
+  ;;
+esac
+
+# set JAVACMD and JAVACCMD
+set_java_home() {
+  # For Cygwin and MinGW, ensure paths are in Unix format before anything is touched
+  if [ -n "${JAVA_HOME-}" ]; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ]; then
+      # IBM's JDK on AIX uses strange locations for the executables
+      JAVACMD="$JAVA_HOME/jre/sh/java"
+      JAVACCMD="$JAVA_HOME/jre/sh/javac"
+    else
+      JAVACMD="$JAVA_HOME/bin/java"
+      JAVACCMD="$JAVA_HOME/bin/javac"
+
+      if [ ! -x "$JAVACMD" ] || [ ! -x "$JAVACCMD" ]; then
+        echo "The JAVA_HOME environment variable is not defined correctly, so mvnw cannot run." >&2
+        echo "JAVA_HOME is set to \"$JAVA_HOME\", but \"\$JAVA_HOME/bin/java\" or \"\$JAVA_HOME/bin/javac\" does not exist." >&2
+        return 1
+      fi
+    fi
+  else
+    JAVACMD="$(
+      'set' +e
+      'unset' -f command 2>/dev/null
+      'command' -v java
+    )" || :
+    JAVACCMD="$(
+      'set' +e
+      'unset' -f command 2>/dev/null
+      'command' -v javac
+    )" || :
+
+    if [ ! -x "${JAVACMD-}" ] || [ ! -x "${JAVACCMD-}" ]; then
+      echo "The java/javac command does not exist in PATH nor is JAVA_HOME set, so mvnw cannot run." >&2
+      return 1
+    fi
+  fi
+}
+
+# hash string like Java String::hashCode
+hash_string() {
+  str="${1:-}" h=0
+  while [ -n "$str" ]; do
+    char="${str%"${str#?}"}"
+    h=$(((h * 31 + $(LC_CTYPE=C printf %d "'$char")) % 4294967296))
+    str="${str#?}"
+  done
+  printf %x\\n $h
+}
+
+verbose() { :; }
+[ "${MVNW_VERBOSE-}" != true ] || verbose() { printf %s\\n "${1-}"; }
+
+die() {
+  printf %s\\n "$1" >&2
+  exit 1
+}
+
+trim() {
+  # MWRAPPER-139:
+  #   Trims trailing and leading whitespace, carriage returns, tabs, and linefeeds.
+  #   Needed for removing poorly interpreted newline sequences when running in more
+  #   exotic environments such as mingw bash on Windows.
+  printf "%s" "${1}" | tr -d '[:space:]'
+}
+
+scriptDir="$(dirname "$0")"
+scriptName="$(basename "$0")"
+
+# parse distributionUrl and optional distributionSha256Sum, requires .mvn/wrapper/maven-wrapper.properties
+while IFS="=" read -r key value; do
+  case "${key-}" in
+  distributionUrl) distributionUrl=$(trim "${value-}") ;;
+  distributionSha256Sum) distributionSha256Sum=$(trim "${value-}") ;;
+  esac
+done <"$scriptDir/.mvn/wrapper/maven-wrapper.properties"
+[ -n "${distributionUrl-}" ] || die "cannot read distributionUrl property in $scriptDir/.mvn/wrapper/maven-wrapper.properties"
+
+case "${distributionUrl##*/}" in
+maven-mvnd-*bin.*)
+  MVN_CMD=mvnd.sh _MVNW_REPO_PATTERN=/maven/mvnd/
+  case "${PROCESSOR_ARCHITECTURE-}${PROCESSOR_ARCHITEW6432-}:$(uname -a)" in
+  *AMD64:CYGWIN* | *AMD64:MINGW*) distributionPlatform=windows-amd64 ;;
+  :Darwin*x86_64) distributionPlatform=darwin-amd64 ;;
+  :Darwin*arm64) distributionPlatform=darwin-aarch64 ;;
+  :Linux*x86_64*) distributionPlatform=linux-amd64 ;;
+  *)
+    echo "Cannot detect native platform for mvnd on $(uname)-$(uname -m), use pure java version" >&2
+    distributionPlatform=linux-amd64
+    ;;
+  esac
+  distributionUrl="${distributionUrl%-bin.*}-$distributionPlatform.zip"
+  ;;
+maven-mvnd-*) MVN_CMD=mvnd.sh _MVNW_REPO_PATTERN=/maven/mvnd/ ;;
+*) MVN_CMD="mvn${scriptName#mvnw}" _MVNW_REPO_PATTERN=/org/apache/maven/ ;;
+esac
+
+# apply MVNW_REPOURL and calculate MAVEN_HOME
+# maven home pattern: ~/.m2/wrapper/dists/{apache-maven-<version>,maven-mvnd-<version>-<platform>}/<hash>
+[ -z "${MVNW_REPOURL-}" ] || distributionUrl="$MVNW_REPOURL$_MVNW_REPO_PATTERN${distributionUrl#*"$_MVNW_REPO_PATTERN"}"
+distributionUrlName="${distributionUrl##*/}"
+distributionUrlNameMain="${distributionUrlName%.*}"
+distributionUrlNameMain="${distributionUrlNameMain%-bin}"
+MAVEN_USER_HOME="${MAVEN_USER_HOME:-${HOME}/.m2}"
+MAVEN_HOME="${MAVEN_USER_HOME}/wrapper/dists/${distributionUrlNameMain-}/$(hash_string "$distributionUrl")"
+
+exec_maven() {
+  unset MVNW_VERBOSE MVNW_USERNAME MVNW_PASSWORD MVNW_REPOURL || :
+  exec "$MAVEN_HOME/bin/$MVN_CMD" "$@" || die "cannot exec $MAVEN_HOME/bin/$MVN_CMD"
+}
+
+if [ -d "$MAVEN_HOME" ]; then
+  verbose "found existing MAVEN_HOME at $MAVEN_HOME"
+  exec_maven "$@"
+fi
+
+case "${distributionUrl-}" in
+*?-bin.zip | *?maven-mvnd-?*-?*.zip) ;;
+*) die "distributionUrl is not valid, must match *-bin.zip or maven-mvnd-*.zip, but found '${distributionUrl-}'" ;;
+esac
+
+# prepare tmp dir
+if TMP_DOWNLOAD_DIR="$(mktemp -d)" && [ -d "$TMP_DOWNLOAD_DIR" ]; then
+  clean() { rm -rf -- "$TMP_DOWNLOAD_DIR"; }
+  trap clean HUP INT TERM EXIT
+else
+  die "cannot create temp dir"
+fi
+
+mkdir -p -- "${MAVEN_HOME%/*}"
+
+# Download and Install Apache Maven
+verbose "Couldn't find MAVEN_HOME, downloading and installing it ..."
+verbose "Downloading from: $distributionUrl"
+verbose "Downloading to: $TMP_DOWNLOAD_DIR/$distributionUrlName"
+
+# select .zip or .tar.gz
+if ! command -v unzip >/dev/null; then
+  distributionUrl="${distributionUrl%.zip}.tar.gz"
+  distributionUrlName="${distributionUrl##*/}"
+fi
+
+# verbose opt
+__MVNW_QUIET_WGET=--quiet __MVNW_QUIET_CURL=--silent __MVNW_QUIET_UNZIP=-q __MVNW_QUIET_TAR=''
+[ "${MVNW_VERBOSE-}" != true ] || __MVNW_QUIET_WGET='' __MVNW_QUIET_CURL='' __MVNW_QUIET_UNZIP='' __MVNW_QUIET_TAR=v
+
+# normalize http auth
+case "${MVNW_PASSWORD:+has-password}" in
+'') MVNW_USERNAME='' MVNW_PASSWORD='' ;;
+has-password) [ -n "${MVNW_USERNAME-}" ] || MVNW_USERNAME='' MVNW_PASSWORD='' ;;
+esac
+
+if [ -z "${MVNW_USERNAME-}" ] && command -v wget >/dev/null; then
+  verbose "Found wget ... using wget"
+  wget ${__MVNW_QUIET_WGET:+"$__MVNW_QUIET_WGET"} "$distributionUrl" -O "$TMP_DOWNLOAD_DIR/$distributionUrlName" || die "wget: Failed to fetch $distributionUrl"
+elif [ -z "${MVNW_USERNAME-}" ] && command -v curl >/dev/null; then
+  verbose "Found curl ... using curl"
+  curl ${__MVNW_QUIET_CURL:+"$__MVNW_QUIET_CURL"} -f -L -o "$TMP_DOWNLOAD_DIR/$distributionUrlName" "$distributionUrl" || die "curl: Failed to fetch $distributionUrl"
+elif set_java_home; then
+  verbose "Falling back to use Java to download"
+  javaSource="$TMP_DOWNLOAD_DIR/Downloader.java"
+  targetZip="$TMP_DOWNLOAD_DIR/$distributionUrlName"
+  cat >"$javaSource" <<-END
+	public class Downloader extends java.net.Authenticator
+	{
+	  protected java.net.PasswordAuthentication getPasswordAuthentication()
+	  {
+	    return new java.net.PasswordAuthentication( System.getenv( "MVNW_USERNAME" ), System.getenv( "MVNW_PASSWORD" ).toCharArray() );
+	  }
+	  public static void main( String[] args ) throws Exception
+	  {
+	    setDefault( new Downloader() );
+	    java.nio.file.Files.copy( java.net.URI.create( args[0] ).toURL().openStream(), java.nio.file.Paths.get( args[1] ).toAbsolutePath().normalize() );
+	  }
+	}
+	END
+  # For Cygwin/MinGW, switch paths to Windows format before running javac and java
+  verbose " - Compiling Downloader.java ..."
+  "$(native_path "$JAVACCMD")" "$(native_path "$javaSource")" || die "Failed to compile Downloader.java"
+  verbose " - Running Downloader.java ..."
+  "$(native_path "$JAVACMD")" -cp "$(native_path "$TMP_DOWNLOAD_DIR")" Downloader "$distributionUrl" "$(native_path "$targetZip")"
+fi
+
+# If specified, validate the SHA-256 sum of the Maven distribution zip file
+if [ -n "${distributionSha256Sum-}" ]; then
+  distributionSha256Result=false
+  if [ "$MVN_CMD" = mvnd.sh ]; then
+    echo "Checksum validation is not supported for maven-mvnd." >&2
+    echo "Please disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties." >&2
+    exit 1
+  elif command -v sha256sum >/dev/null; then
+    if echo "$distributionSha256Sum  $TMP_DOWNLOAD_DIR/$distributionUrlName" | sha256sum -c - >/dev/null 2>&1; then
+      distributionSha256Result=true
+    fi
+  elif command -v shasum >/dev/null; then
+    if echo "$distributionSha256Sum  $TMP_DOWNLOAD_DIR/$distributionUrlName" | shasum -a 256 -c >/dev/null 2>&1; then
+      distributionSha256Result=true
+    fi
+  else
+    echo "Checksum validation was requested but neither 'sha256sum' or 'shasum' are available." >&2
+    echo "Please install either command, or disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties." >&2
+    exit 1
+  fi
+  if [ $distributionSha256Result = false ]; then
+    echo "Error: Failed to validate Maven distribution SHA-256, your Maven distribution might be compromised." >&2
+    echo "If you updated your Maven version, you need to update the specified distributionSha256Sum property." >&2
+    exit 1
+  fi
+fi
+
+# unzip and move
+if command -v unzip >/dev/null; then
+  unzip ${__MVNW_QUIET_UNZIP:+"$__MVNW_QUIET_UNZIP"} "$TMP_DOWNLOAD_DIR/$distributionUrlName" -d "$TMP_DOWNLOAD_DIR" || die "failed to unzip"
+else
+  tar xzf${__MVNW_QUIET_TAR:+"$__MVNW_QUIET_TAR"} "$TMP_DOWNLOAD_DIR/$distributionUrlName" -C "$TMP_DOWNLOAD_DIR" || die "failed to untar"
+fi
+
+# Find the actual extracted directory name (handles snapshots where filename != directory name)
+actualDistributionDir=""
+
+# First try the expected directory name (for regular distributions)
+if [ -d "$TMP_DOWNLOAD_DIR/$distributionUrlNameMain" ]; then
+  if [ -f "$TMP_DOWNLOAD_DIR/$distributionUrlNameMain/bin/$MVN_CMD" ]; then
+    actualDistributionDir="$distributionUrlNameMain"
+  fi
+fi
+
+# If not found, search for any directory with the Maven executable (for snapshots)
+if [ -z "$actualDistributionDir" ]; then
+  # enable globbing to iterate over items
+  set +f
+  for dir in "$TMP_DOWNLOAD_DIR"/*; do
+    if [ -d "$dir" ]; then
+      if [ -f "$dir/bin/$MVN_CMD" ]; then
+        actualDistributionDir="$(basename "$dir")"
+        break
+      fi
+    fi
+  done
+  set -f
+fi
+
+if [ -z "$actualDistributionDir" ]; then
+  verbose "Contents of $TMP_DOWNLOAD_DIR:"
+  verbose "$(ls -la "$TMP_DOWNLOAD_DIR")"
+  die "Could not find Maven distribution directory in extracted archive"
+fi
+
+verbose "Found extracted Maven distribution directory: $actualDistributionDir"
+printf %s\\n "$distributionUrl" >"$TMP_DOWNLOAD_DIR/$actualDistributionDir/mvnw.url"
+mv -- "$TMP_DOWNLOAD_DIR/$actualDistributionDir" "$MAVEN_HOME" || [ -d "$MAVEN_HOME" ] || die "fail to move MAVEN_HOME"
+
+clean || :
+exec_maven "$@"
diff --git a/mvnw.cmd b/mvnw.cmd
new file mode 100644
index 0000000..92450f9
--- /dev/null
+++ b/mvnw.cmd
@@ -0,0 +1,189 @@
+<# : batch portion
+@REM ----------------------------------------------------------------------------
+@REM Licensed to the Apache Software Foundation (ASF) under one
+@REM or more contributor license agreements.  See the NOTICE file
+@REM distributed with this work for additional information
+@REM regarding copyright ownership.  The ASF licenses this file
+@REM to you under the Apache License, Version 2.0 (the
+@REM "License"); you may not use this file except in compliance
+@REM with the License.  You may obtain a copy of the License at
+@REM
+@REM    http://www.apache.org/licenses/LICENSE-2.0
+@REM
+@REM Unless required by applicable law or agreed to in writing,
+@REM software distributed under the License is distributed on an
+@REM "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+@REM KIND, either express or implied.  See the License for the
+@REM specific language governing permissions and limitations
+@REM under the License.
+@REM ----------------------------------------------------------------------------
+
+@REM ----------------------------------------------------------------------------
+@REM Apache Maven Wrapper startup batch script, version 3.3.4
+@REM
+@REM Optional ENV vars
+@REM   MVNW_REPOURL - repo url base for downloading maven distribution
+@REM   MVNW_USERNAME/MVNW_PASSWORD - user and password for downloading maven
+@REM   MVNW_VERBOSE - true: enable verbose log; others: silence the output
+@REM ----------------------------------------------------------------------------
+
+@IF "%__MVNW_ARG0_NAME__%"=="" (SET __MVNW_ARG0_NAME__=%~nx0)
+@SET __MVNW_CMD__=
+@SET __MVNW_ERROR__=
+@SET __MVNW_PSMODULEP_SAVE=%PSModulePath%
+@SET PSModulePath=
+@FOR /F "usebackq tokens=1* delims==" %%A IN (`powershell -noprofile "& {$scriptDir='%~dp0'; $script='%__MVNW_ARG0_NAME__%'; icm -ScriptBlock ([Scriptblock]::Create((Get-Content -Raw '%~f0'))) -NoNewScope}"`) DO @(
+  IF "%%A"=="MVN_CMD" (set __MVNW_CMD__=%%B) ELSE IF "%%B"=="" (echo %%A) ELSE (echo %%A=%%B)
+)
+@SET PSModulePath=%__MVNW_PSMODULEP_SAVE%
+@SET __MVNW_PSMODULEP_SAVE=
+@SET __MVNW_ARG0_NAME__=
+@SET MVNW_USERNAME=
+@SET MVNW_PASSWORD=
+@IF NOT "%__MVNW_CMD__%"=="" ("%__MVNW_CMD__%" %*)
+@echo Cannot start maven from wrapper >&2 && exit /b 1
+@GOTO :EOF
+: end batch / begin powershell #>
+
+$ErrorActionPreference = "Stop"
+if ($env:MVNW_VERBOSE -eq "true") {
+  $VerbosePreference = "Continue"
+}
+
+# calculate distributionUrl, requires .mvn/wrapper/maven-wrapper.properties
+$distributionUrl = (Get-Content -Raw "$scriptDir/.mvn/wrapper/maven-wrapper.properties" | ConvertFrom-StringData).distributionUrl
+if (!$distributionUrl) {
+  Write-Error "cannot read distributionUrl property in $scriptDir/.mvn/wrapper/maven-wrapper.properties"
+}
+
+switch -wildcard -casesensitive ( $($distributionUrl -replace '^.*/','') ) {
+  "maven-mvnd-*" {
+    $USE_MVND = $true
+    $distributionUrl = $distributionUrl -replace '-bin\.[^.]*$',"-windows-amd64.zip"
+    $MVN_CMD = "mvnd.cmd"
+    break
+  }
+  default {
+    $USE_MVND = $false
+    $MVN_CMD = $script -replace '^mvnw','mvn'
+    break
+  }
+}
+
+# apply MVNW_REPOURL and calculate MAVEN_HOME
+# maven home pattern: ~/.m2/wrapper/dists/{apache-maven-<version>,maven-mvnd-<version>-<platform>}/<hash>
+if ($env:MVNW_REPOURL) {
+  $MVNW_REPO_PATTERN = if ($USE_MVND -eq $False) { "/org/apache/maven/" } else { "/maven/mvnd/" }
+  $distributionUrl = "$env:MVNW_REPOURL$MVNW_REPO_PATTERN$($distributionUrl -replace "^.*$MVNW_REPO_PATTERN",'')"
+}
+$distributionUrlName = $distributionUrl -replace '^.*/',''
+$distributionUrlNameMain = $distributionUrlName -replace '\.[^.]*$','' -replace '-bin$',''
+
+$MAVEN_M2_PATH = "$HOME/.m2"
+if ($env:MAVEN_USER_HOME) {
+  $MAVEN_M2_PATH = "$env:MAVEN_USER_HOME"
+}
+
+if (-not (Test-Path -Path $MAVEN_M2_PATH)) {
+    New-Item -Path $MAVEN_M2_PATH -ItemType Directory | Out-Null
+}
+
+$MAVEN_WRAPPER_DISTS = $null
+if ((Get-Item $MAVEN_M2_PATH).Target[0] -eq $null) {
+  $MAVEN_WRAPPER_DISTS = "$MAVEN_M2_PATH/wrapper/dists"
+} else {
+  $MAVEN_WRAPPER_DISTS = (Get-Item $MAVEN_M2_PATH).Target[0] + "/wrapper/dists"
+}
+
+$MAVEN_HOME_PARENT = "$MAVEN_WRAPPER_DISTS/$distributionUrlNameMain"
+$MAVEN_HOME_NAME = ([System.Security.Cryptography.SHA256]::Create().ComputeHash([byte[]][char[]]$distributionUrl) | ForEach-Object {$_.ToString("x2")}) -join ''
+$MAVEN_HOME = "$MAVEN_HOME_PARENT/$MAVEN_HOME_NAME"
+
+if (Test-Path -Path "$MAVEN_HOME" -PathType Container) {
+  Write-Verbose "found existing MAVEN_HOME at $MAVEN_HOME"
+  Write-Output "MVN_CMD=$MAVEN_HOME/bin/$MVN_CMD"
+  exit $?
+}
+
+if (! $distributionUrlNameMain -or ($distributionUrlName -eq $distributionUrlNameMain)) {
+  Write-Error "distributionUrl is not valid, must end with *-bin.zip, but found $distributionUrl"
+}
+
+# prepare tmp dir
+$TMP_DOWNLOAD_DIR_HOLDER = New-TemporaryFile
+$TMP_DOWNLOAD_DIR = New-Item -Itemtype Directory -Path "$TMP_DOWNLOAD_DIR_HOLDER.dir"
+$TMP_DOWNLOAD_DIR_HOLDER.Delete() | Out-Null
+trap {
+  if ($TMP_DOWNLOAD_DIR.Exists) {
+    try { Remove-Item $TMP_DOWNLOAD_DIR -Recurse -Force | Out-Null }
+    catch { Write-Warning "Cannot remove $TMP_DOWNLOAD_DIR" }
+  }
+}
+
+New-Item -Itemtype Directory -Path "$MAVEN_HOME_PARENT" -Force | Out-Null
+
+# Download and Install Apache Maven
+Write-Verbose "Couldn't find MAVEN_HOME, downloading and installing it ..."
+Write-Verbose "Downloading from: $distributionUrl"
+Write-Verbose "Downloading to: $TMP_DOWNLOAD_DIR/$distributionUrlName"
+
+$webclient = New-Object System.Net.WebClient
+if ($env:MVNW_USERNAME -and $env:MVNW_PASSWORD) {
+  $webclient.Credentials = New-Object System.Net.NetworkCredential($env:MVNW_USERNAME, $env:MVNW_PASSWORD)
+}
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+$webclient.DownloadFile($distributionUrl, "$TMP_DOWNLOAD_DIR/$distributionUrlName") | Out-Null
+
+# If specified, validate the SHA-256 sum of the Maven distribution zip file
+$distributionSha256Sum = (Get-Content -Raw "$scriptDir/.mvn/wrapper/maven-wrapper.properties" | ConvertFrom-StringData).distributionSha256Sum
+if ($distributionSha256Sum) {
+  if ($USE_MVND) {
+    Write-Error "Checksum validation is not supported for maven-mvnd. `nPlease disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties."
+  }
+  Import-Module $PSHOME\Modules\Microsoft.PowerShell.Utility -Function Get-FileHash
+  if ((Get-FileHash "$TMP_DOWNLOAD_DIR/$distributionUrlName" -Algorithm SHA256).Hash.ToLower() -ne $distributionSha256Sum) {
+    Write-Error "Error: Failed to validate Maven distribution SHA-256, your Maven distribution might be compromised. If you updated your Maven version, you need to update the specified distributionSha256Sum property."
+  }
+}
+
+# unzip and move
+Expand-Archive "$TMP_DOWNLOAD_DIR/$distributionUrlName" -DestinationPath "$TMP_DOWNLOAD_DIR" | Out-Null
+
+# Find the actual extracted directory name (handles snapshots where filename != directory name)
+$actualDistributionDir = ""
+
+# First try the expected directory name (for regular distributions)
+$expectedPath = Join-Path "$TMP_DOWNLOAD_DIR" "$distributionUrlNameMain"
+$expectedMvnPath = Join-Path "$expectedPath" "bin/$MVN_CMD"
+if ((Test-Path -Path $expectedPath -PathType Container) -and (Test-Path -Path $expectedMvnPath -PathType Leaf)) {
+  $actualDistributionDir = $distributionUrlNameMain
+}
+
+# If not found, search for any directory with the Maven executable (for snapshots)
+if (!$actualDistributionDir) {
+  Get-ChildItem -Path "$TMP_DOWNLOAD_DIR" -Directory | ForEach-Object {
+    $testPath = Join-Path $_.FullName "bin/$MVN_CMD"
+    if (Test-Path -Path $testPath -PathType Leaf) {
+      $actualDistributionDir = $_.Name
+    }
+  }
+}
+
+if (!$actualDistributionDir) {
+  Write-Error "Could not find Maven distribution directory in extracted archive"
+}
+
+Write-Verbose "Found extracted Maven distribution directory: $actualDistributionDir"
+Rename-Item -Path "$TMP_DOWNLOAD_DIR/$actualDistributionDir" -NewName $MAVEN_HOME_NAME | Out-Null
+try {
+  Move-Item -Path "$TMP_DOWNLOAD_DIR/$MAVEN_HOME_NAME" -Destination $MAVEN_HOME_PARENT | Out-Null
+} catch {
+  if (! (Test-Path -Path "$MAVEN_HOME" -PathType Container)) {
+    Write-Error "fail to move MAVEN_HOME"
+  }
+} finally {
+  try { Remove-Item $TMP_DOWNLOAD_DIR -Recurse -Force | Out-Null }
+  catch { Write-Warning "Cannot remove $TMP_DOWNLOAD_DIR" }
+}
+
+Write-Output "MVN_CMD=$MAVEN_HOME/bin/$MVN_CMD"
diff --git a/pom.xml b/pom.xml
new file mode 100644
index 0000000..0db6abf
--- /dev/null
+++ b/pom.xml
@@ -0,0 +1,113 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>org.springframework.boot</groupId>
+		<artifactId>spring-boot-starter-parent</artifactId>
+		<version>4.0.0</version>
+		<relativePath/> <!-- lookup parent from repository -->
+	</parent>
+	<groupId>com.heaerie.server.auth201</groupId>
+	<artifactId>Auth201Server</artifactId>
+	<version>0.0.1-SNAPSHOT</version>
+	<name>Auth201Server</name>
+	<description>Auth Server</description>
+	<url/>
+	<licenses>
+		<license/>
+	</licenses>
+	<developers>
+		<developer/>
+	</developers>
+	<scm>
+		<connection/>
+		<developerConnection/>
+		<tag/>
+		<url/>
+	</scm>
+	<properties>
+		<java.version>21</java.version>
+	</properties>
+	<dependencies>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-web</artifactId>
+		</dependency>
+		
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-security</artifactId>
+		</dependency>
+		
+		<dependency>
+			<groupId>org.springframework.security</groupId>
+			<artifactId>spring-security-oauth2-authorization-server</artifactId>
+		</dependency>
+		
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-data-jpa</artifactId>
+		</dependency>
+		
+		<dependency>
+			<groupId>com.h2database</groupId>
+			<artifactId>h2</artifactId>
+			<scope>runtime</scope>
+		</dependency>
+		
+		<dependency>
+			<groupId>commons-logging</groupId>
+			<artifactId>commons-logging</artifactId>
+			<version>1.3.0</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.projectlombok</groupId>
+			<artifactId>lombok</artifactId>
+			<optional>true</optional>
+		</dependency>
+		
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-test</artifactId>
+			<scope>test</scope>
+		</dependency>
+		
+		<dependency>
+			<groupId>org.springframework.security</groupId>
+			<artifactId>spring-security-test</artifactId>
+			<scope>test</scope>
+		</dependency>
+	</dependencies>
+
+	<build>
+		<plugins>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-compiler-plugin</artifactId>
+				<configuration>
+					<annotationProcessorPaths>
+						<path>
+							<groupId>org.projectlombok</groupId>
+							<artifactId>lombok</artifactId>
+						</path>
+					</annotationProcessorPaths>
+				</configuration>
+			</plugin>
+			<plugin>
+				<groupId>org.springframework.boot</groupId>
+				<artifactId>spring-boot-maven-plugin</artifactId>
+				<configuration>
+					<excludes>
+						<exclude>
+							<groupId>org.projectlombok</groupId>
+							<artifactId>lombok</artifactId>
+						</exclude>
+					</excludes>
+				</configuration>
+			</plugin>
+		</plugins>
+	</build>
+
+</project>
diff --git a/postman_collection.json b/postman_collection.json
new file mode 100644
index 0000000..5d0dad2
--- /dev/null
+++ b/postman_collection.json
@@ -0,0 +1,342 @@
+{
+  "info": {
+    "name": "OAuth 2.1 Authorization Server",
+    "description": "Collection for testing OAuth 2.1 flows",
+    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
+  },
+  "variable": [
+    {
+      "key": "base_url",
+      "value": "http://localhost:9000"
+    },
+    {
+      "key": "client_id",
+      "value": "public-client"
+    },
+    {
+      "key": "confidential_client_id",
+      "value": "confidential-client"
+    },
+    {
+      "key": "confidential_client_secret",
+      "value": "secret"
+    },
+    {
+      "key": "redirect_uri",
+      "value": "http://127.0.0.1:8080/authorized"
+    },
+    {
+      "key": "authorization_code",
+      "value": ""
+    },
+    {
+      "key": "access_token",
+      "value": ""
+    },
+    {
+      "key": "refresh_token",
+      "value": ""
+    },
+    {
+      "key": "code_verifier",
+      "value": ""
+    }
+  ],
+  "item": [
+    {
+      "name": "Well-Known Configuration",
+      "request": {
+        "method": "GET",
+        "header": [],
+        "url": {
+          "raw": "{{base_url}}/.well-known/oauth-authorization-server",
+          "host": ["{{base_url}}"],
+          "path": [".well-known", "oauth-authorization-server"]
+        }
+      }
+    },
+    {
+      "name": "JWK Set",
+      "request": {
+        "method": "GET",
+        "header": [],
+        "url": {
+          "raw": "{{base_url}}/oauth2/jwks",
+          "host": ["{{base_url}}"],
+          "path": ["oauth2", "jwks"]
+        }
+      }
+    },
+    {
+      "name": "Token - Authorization Code (Public Client)",
+      "event": [
+        {
+          "listen": "test",
+          "script": {
+            "exec": [
+              "if (pm.response.code === 200) {",
+              "    const response = pm.response.json();",
+              "    pm.collectionVariables.set('access_token', response.access_token);",
+              "    pm.collectionVariables.set('refresh_token', response.refresh_token);",
+              "}"
+            ]
+          }
+        }
+      ],
+      "request": {
+        "method": "POST",
+        "header": [
+          {
+            "key": "Content-Type",
+            "value": "application/x-www-form-urlencoded"
+          }
+        ],
+        "body": {
+          "mode": "urlencoded",
+          "urlencoded": [
+            {
+              "key": "grant_type",
+              "value": "authorization_code"
+            },
+            {
+              "key": "code",
+              "value": "{{authorization_code}}"
+            },
+            {
+              "key": "redirect_uri",
+              "value": "{{redirect_uri}}"
+            },
+            {
+              "key": "client_id",
+              "value": "{{client_id}}"
+            },
+            {
+              "key": "code_verifier",
+              "value": "{{code_verifier}}"
+            }
+          ]
+        },
+        "url": {
+          "raw": "{{base_url}}/oauth2/token",
+          "host": ["{{base_url}}"],
+          "path": ["oauth2", "token"]
+        }
+      }
+    },
+    {
+      "name": "Token - Client Credentials",
+      "event": [
+        {
+          "listen": "test",
+          "script": {
+            "exec": [
+              "if (pm.response.code === 200) {",
+              "    const response = pm.response.json();",
+              "    pm.collectionVariables.set('access_token', response.access_token);",
+              "}"
+            ]
+          }
+        }
+      ],
+      "request": {
+        "auth": {
+          "type": "basic",
+          "basic": [
+            {
+              "key": "username",
+              "value": "{{confidential_client_id}}"
+            },
+            {
+              "key": "password",
+              "value": "{{confidential_client_secret}}"
+            }
+          ]
+        },
+        "method": "POST",
+        "header": [
+          {
+            "key": "Content-Type",
+            "value": "application/x-www-form-urlencoded"
+          }
+        ],
+        "body": {
+          "mode": "urlencoded",
+          "urlencoded": [
+            {
+              "key": "grant_type",
+              "value": "client_credentials"
+            },
+            {
+              "key": "scope",
+              "value": "read write"
+            }
+          ]
+        },
+        "url": {
+          "raw": "{{base_url}}/oauth2/token",
+          "host": ["{{base_url}}"],
+          "path": ["oauth2", "token"]
+        }
+      }
+    },
+    {
+      "name": "Token - Refresh Token",
+      "event": [
+        {
+          "listen": "test",
+          "script": {
+            "exec": [
+              "if (pm.response.code === 200) {",
+              "    const response = pm.response.json();",
+              "    pm.collectionVariables.set('access_token', response.access_token);",
+              "    pm.collectionVariables.set('refresh_token', response.refresh_token);",
+              "}"
+            ]
+          }
+        }
+      ],
+      "request": {
+        "method": "POST",
+        "header": [
+          {
+            "key": "Content-Type",
+            "value": "application/x-www-form-urlencoded"
+          }
+        ],
+        "body": {
+          "mode": "urlencoded",
+          "urlencoded": [
+            {
+              "key": "grant_type",
+              "value": "refresh_token"
+            },
+            {
+              "key": "refresh_token",
+              "value": "{{refresh_token}}"
+            },
+            {
+              "key": "client_id",
+              "value": "{{client_id}}"
+            }
+          ]
+        },
+        "url": {
+          "raw": "{{base_url}}/oauth2/token",
+          "host": ["{{base_url}}"],
+          "path": ["oauth2", "token"]
+        }
+      }
+    },
+    {
+      "name": "UserInfo",
+      "request": {
+        "auth": {
+          "type": "bearer",
+          "bearer": [
+            {
+              "key": "token",
+              "value": "{{access_token}}"
+            }
+          ]
+        },
+        "method": "GET",
+        "header": [],
+        "url": {
+          "raw": "{{base_url}}/userinfo",
+          "host": ["{{base_url}}"],
+          "path": ["userinfo"]
+        }
+      }
+    },
+    {
+      "name": "Token Introspection",
+      "request": {
+        "auth": {
+          "type": "basic",
+          "basic": [
+            {
+              "key": "username",
+              "value": "{{confidential_client_id}}"
+            },
+            {
+              "key": "password",
+              "value": "{{confidential_client_secret}}"
+            }
+          ]
+        },
+        "method": "POST",
+        "header": [
+          {
+            "key": "Content-Type",
+            "value": "application/x-www-form-urlencoded"
+          }
+        ],
+        "body": {
+          "mode": "urlencoded",
+          "urlencoded": [
+            {
+              "key": "token",
+              "value": "{{access_token}}"
+            }
+          ]
+        },
+        "url": {
+          "raw": "{{base_url}}/oauth2/introspect",
+          "host": ["{{base_url}}"],
+          "path": ["oauth2", "introspect"]
+        }
+      }
+    },
+    {
+      "name": "Token Revocation",
+      "request": {
+        "auth": {
+          "type": "basic",
+          "basic": [
+            {
+              "key": "username",
+              "value": "{{confidential_client_id}}"
+            },
+            {
+              "key": "password",
+              "value": "{{confidential_client_secret}}"
+            }
+          ]
+        },
+        "method": "POST",
+        "header": [
+          {
+            "key": "Content-Type",
+            "value": "application/x-www-form-urlencoded"
+          }
+        ],
+        "body": {
+          "mode": "urlencoded",
+          "urlencoded": [
+            {
+              "key": "token",
+              "value": "{{access_token}}"
+            }
+          ]
+        },
+        "url": {
+          "raw": "{{base_url}}/oauth2/revoke",
+          "host": ["{{base_url}}"],
+          "path": ["oauth2", "revoke"]
+        }
+      }
+    },
+    {
+      "name": "Home",
+      "request": {
+        "method": "GET",
+        "header": [],
+        "url": {
+          "raw": "{{base_url}}/",
+          "host": ["{{base_url}}"],
+          "path": [""]
+        }
+      }
+    }
+  ]
+}
diff --git a/src/main/java/com/heaerie/server/auth201/Auth201Server/Auth201ServerApplication.java b/src/main/java/com/heaerie/server/auth201/Auth201Server/Auth201ServerApplication.java
new file mode 100644
index 0000000..d47e55b
--- /dev/null
+++ b/src/main/java/com/heaerie/server/auth201/Auth201Server/Auth201ServerApplication.java
@@ -0,0 +1,13 @@
+package com.heaerie.server.auth201.Auth201Server;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class Auth201ServerApplication {
+
+	public static void main(String[] args) {
+		SpringApplication.run(Auth201ServerApplication.class, args);
+	}
+
+}
diff --git a/src/main/java/com/heaerie/server/auth201/Auth201Server/config/SecurityConfig.java b/src/main/java/com/heaerie/server/auth201/Auth201Server/config/SecurityConfig.java
new file mode 100644
index 0000000..4fecc34
--- /dev/null
+++ b/src/main/java/com/heaerie/server/auth201/Auth201Server/config/SecurityConfig.java
@@ -0,0 +1,211 @@
+package com.heaerie.server.auth201.Auth201Server.config;
+
+import com.nimbusds.jose.jwk.JWKSet;
+import com.nimbusds.jose.jwk.RSAKey;
+import com.nimbusds.jose.jwk.source.ImmutableJWKSet;
+import com.nimbusds.jose.jwk.source.JWKSource;
+import com.nimbusds.jose.proc.SecurityContext;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.oauth2.core.AuthorizationGrantType;
+import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
+import org.springframework.security.oauth2.core.oidc.OidcScopes;
+import org.springframework.security.oauth2.jwt.JwtDecoder;
+import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
+import org.springframework.security.oauth2.server.authorization.client.InMemoryRegisteredClientRepository;
+import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
+import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
+import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
+import org.springframework.security.oauth2.server.authorization.settings.ClientSettings;
+import org.springframework.security.oauth2.server.authorization.settings.TokenSettings;
+import org.springframework.security.provisioning.InMemoryUserDetailsManager;
+import org.springframework.security.web.SecurityFilterChain;
+
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.interfaces.RSAPrivateKey;
+import java.security.interfaces.RSAPublicKey;
+import java.time.Duration;
+import java.util.UUID;
+
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    /**
+     * Default Security Filter Chain for authentication
+     * Handles login and OAuth 2.1 authorization
+     */
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        http
+            .authorizeHttpRequests(authorize -> authorize
+                .requestMatchers("/", "/h2-console/**").permitAll()
+                .anyRequest().authenticated()
+            )
+            .formLogin(Customizer.withDefaults())
+            .oauth2ResourceServer(oauth2 -> oauth2
+                .jwt(Customizer.withDefaults())
+            );
+        
+        // Allow H2 console access (development only)
+        http.csrf(csrf -> csrf
+            .ignoringRequestMatchers("/h2-console/**")
+        );
+        http.headers(headers -> headers
+            .frameOptions(frame -> frame.sameOrigin())
+        );
+
+        return http.build();
+    }
+
+    /**
+     * Registered Client Repository with OAuth 2.1 compliant configuration
+     * This example uses in-memory storage, but you can implement database storage
+     */
+    @Bean
+    public RegisteredClientRepository registeredClientRepository() {
+        // OAuth 2.1 Public Client with PKCE (recommended for SPAs and mobile apps)
+        RegisteredClient publicClient = RegisteredClient.withId(UUID.randomUUID().toString())
+            .clientId("public-client")
+            // No client secret for public clients (OAuth 2.1 requirement)
+            .clientAuthenticationMethod(ClientAuthenticationMethod.NONE)
+            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+            .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
+            .redirectUri("http://127.0.0.1:8080/login/oauth2/code/public-client")
+            .redirectUri("http://127.0.0.1:8080/authorized")
+            .postLogoutRedirectUri("http://127.0.0.1:8080/logged-out")
+            .scope(OidcScopes.OPENID)
+            .scope(OidcScopes.PROFILE)
+            .scope(OidcScopes.EMAIL)
+            .scope("read")
+            .scope("write")
+            .clientSettings(ClientSettings.builder()
+                .requireAuthorizationConsent(true)
+                .requireProofKey(true) // PKCE is required (OAuth 2.1)
+                .build())
+            .tokenSettings(TokenSettings.builder()
+                .accessTokenTimeToLive(Duration.ofMinutes(15))
+                .refreshTokenTimeToLive(Duration.ofHours(24))
+                .reuseRefreshTokens(false) // OAuth 2.1: Refresh token rotation
+                .build())
+            .build();
+
+        // OAuth 2.1 Confidential Client (for server-to-server)
+        RegisteredClient confidentialClient = RegisteredClient.withId(UUID.randomUUID().toString())
+            .clientId("confidential-client")
+            .clientSecret("{bcrypt}$2a$10$MJJhX9K8bGqVHJwF8X8o6O5fF5F5F5F5F5F5F5F5F5F5F5F5F5F5F") // "secret"
+            .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
+            .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST)
+            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+            .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
+            .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
+            .redirectUri("http://127.0.0.1:8080/login/oauth2/code/confidential-client")
+            .redirectUri("http://127.0.0.1:8080/authorized")
+            .postLogoutRedirectUri("http://127.0.0.1:8080/logged-out")
+            .scope(OidcScopes.OPENID)
+            .scope(OidcScopes.PROFILE)
+            .scope(OidcScopes.EMAIL)
+            .scope("read")
+            .scope("write")
+            .clientSettings(ClientSettings.builder()
+                .requireAuthorizationConsent(true)
+                .requireProofKey(true) // PKCE recommended even for confidential clients
+                .build())
+            .tokenSettings(TokenSettings.builder()
+                .accessTokenTimeToLive(Duration.ofMinutes(15))
+                .refreshTokenTimeToLive(Duration.ofHours(24))
+                .reuseRefreshTokens(false) // OAuth 2.1: Refresh token rotation
+                .build())
+            .build();
+
+        return new InMemoryRegisteredClientRepository(publicClient, confidentialClient);
+    }
+
+    /**
+     * User Details Service for authentication
+     * In production, this should be backed by a database
+     */
+    @Bean
+    public UserDetailsService userDetailsService() {
+        UserDetails user = User.builder()
+            .username("user")
+            .password(passwordEncoder().encode("password"))
+            .roles("USER")
+            .build();
+
+        UserDetails admin = User.builder()
+            .username("admin")
+            .password(passwordEncoder().encode("admin"))
+            .roles("USER", "ADMIN")
+            .build();
+
+        return new InMemoryUserDetailsManager(user, admin);
+    }
+
+    /**
+     * Password Encoder
+     */
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+
+    /**
+     * JWK Source for signing JWT tokens
+     */
+    @Bean
+    public JWKSource<SecurityContext> jwkSource() {
+        KeyPair keyPair = generateRsaKey();
+        RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
+        RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
+        RSAKey rsaKey = new RSAKey.Builder(publicKey)
+            .privateKey(privateKey)
+            .keyID(UUID.randomUUID().toString())
+            .build();
+        JWKSet jwkSet = new JWKSet(rsaKey);
+        return new ImmutableJWKSet<>(jwkSet);
+    }
+
+    /**
+     * Generate RSA key pair for JWT signing
+     */
+    private static KeyPair generateRsaKey() {
+        KeyPair keyPair;
+        try {
+            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
+            keyPairGenerator.initialize(2048);
+            keyPair = keyPairGenerator.generateKeyPair();
+        } catch (Exception ex) {
+            throw new IllegalStateException(ex);
+        }
+        return keyPair;
+    }
+
+    /**
+     * JWT Decoder for validating JWT tokens
+     */
+    @Bean
+    public JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) {
+        return NimbusJwtDecoder.withJwkSetUri("http://localhost:9000/oauth2/jwks").build();
+    }
+
+    /**
+     * Authorization Server Settings
+     * Configures the OAuth 2.1 endpoints
+     */
+    @Bean
+    public AuthorizationServerSettings authorizationServerSettings() {
+        return AuthorizationServerSettings.builder()
+            .issuer("http://localhost:9000")
+            .build();
+    }
+}
diff --git a/src/main/java/com/heaerie/server/auth201/Auth201Server/controller/UserController.java b/src/main/java/com/heaerie/server/auth201/Auth201Server/controller/UserController.java
new file mode 100644
index 0000000..8dd08de
--- /dev/null
+++ b/src/main/java/com/heaerie/server/auth201/Auth201Server/controller/UserController.java
@@ -0,0 +1,38 @@
+package com.heaerie.server.auth201.Auth201Server.controller;
+
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Map;
+
+@RestController
+public class UserController {
+
+    /**
+     * Endpoint to get user information (protected resource)
+     * Requires a valid access token
+     */
+    @GetMapping("/userinfo")
+    public Map<String, Object> userInfo(@AuthenticationPrincipal Jwt jwt) {
+        return Map.of(
+            "sub", jwt.getSubject(),
+            "username", jwt.getClaimAsString("sub"),
+            "scopes", jwt.getClaimAsStringList("scope"),
+            "exp", jwt.getExpiresAt(),
+            "iat", jwt.getIssuedAt()
+        );
+    }
+
+    /**
+     * Public endpoint to check server status
+     */
+    @GetMapping("/")
+    public Map<String, String> home() {
+        return Map.of(
+            "message", "OAuth 2.1 Authorization Server is running",
+            "wellKnown", "http://localhost:9000/.well-known/oauth-authorization-server"
+        );
+    }
+}
diff --git a/src/main/resources/application.yaml b/src/main/resources/application.yaml
new file mode 100644
index 0000000..f635cd3
--- /dev/null
+++ b/src/main/resources/application.yaml
@@ -0,0 +1,36 @@
+spring:
+  application:
+    name: Auth201Server
+  
+  # H2 Database Configuration (In-Memory for development)
+  datasource:
+    url: jdbc:h2:mem:oauth2db
+    driver-class-name: org.h2.Driver
+    username: sa
+    password: 
+  
+  # JPA Configuration
+  jpa:
+    database-platform: org.hibernate.dialect.H2Dialect
+    hibernate:
+      ddl-auto: create-drop
+    show-sql: true
+    properties:
+      hibernate:
+        format_sql: true
+  
+  # H2 Console (for development only)
+  h2:
+    console:
+      enabled: true
+      path: /h2-console
+
+# Server Configuration
+server:
+  port: 9000
+
+# Logging Configuration
+logging:
+  level:
+    org.springframework.security: DEBUG
+    org.springframework.security.oauth2: DEBUG
diff --git a/src/test/java/com/heaerie/server/auth201/Auth201Server/Auth201ServerApplicationTests.java b/src/test/java/com/heaerie/server/auth201/Auth201Server/Auth201ServerApplicationTests.java
new file mode 100644
index 0000000..d9f9bd7
--- /dev/null
+++ b/src/test/java/com/heaerie/server/auth201/Auth201Server/Auth201ServerApplicationTests.java
@@ -0,0 +1,13 @@
+package com.heaerie.server.auth201.Auth201Server;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.test.context.SpringBootTest;
+
+@SpringBootTest
+class Auth201ServerApplicationTests {
+
+	@Test
+	void contextLoads() {
+	}
+
+}
diff --git a/test-oauth.sh b/test-oauth.sh
new file mode 100755
index 0000000..dad62aa
--- /dev/null
+++ b/test-oauth.sh
@@ -0,0 +1,96 @@
+#!/bin/bash
+
+# OAuth 2.1 Test Script
+# This script demonstrates how to test OAuth 2.1 flows
+
+BASE_URL="http://localhost:9000"
+CLIENT_ID="public-client"
+CONFIDENTIAL_CLIENT_ID="confidential-client"
+CONFIDENTIAL_CLIENT_SECRET="secret"
+REDIRECT_URI="http://127.0.0.1:8080/authorized"
+
+echo "================================"
+echo "OAuth 2.1 Authorization Server"
+echo "================================"
+echo ""
+
+# 1. Test Well-Known Configuration
+echo "1. Fetching Well-Known Configuration..."
+curl -s "$BASE_URL/.well-known/oauth-authorization-server" | jq '.' || echo "Server not running or jq not installed"
+echo ""
+
+# 2. Generate PKCE Challenge
+echo "2. Generating PKCE Challenge..."
+CODE_VERIFIER=$(openssl rand -base64 32 | tr -d '+/' | tr '=' '_' | cut -c1-43)
+CODE_CHALLENGE=$(echo -n "$CODE_VERIFIER" | openssl dgst -binary -sha256 | openssl base64 | tr -d '+/' | tr '=' '_')
+
+echo "   Code Verifier: $CODE_VERIFIER"
+echo "   Code Challenge: $CODE_CHALLENGE"
+echo ""
+
+# 3. Authorization Request
+echo "3. Authorization Request (Open in browser):"
+AUTH_URL="$BASE_URL/oauth2/authorize?response_type=code&client_id=$CLIENT_ID&redirect_uri=$REDIRECT_URI&scope=openid%20profile%20email%20read%20write&code_challenge=$CODE_CHALLENGE&code_challenge_method=S256&state=xyz123"
+echo "   $AUTH_URL"
+echo ""
+echo "   Login with: user / password"
+echo "   After approval, you'll be redirected to:"
+echo "   $REDIRECT_URI?code=AUTHORIZATION_CODE&state=xyz123"
+echo ""
+
+# 4. Prompt for Authorization Code
+read -p "4. Enter the authorization code from redirect: " AUTH_CODE
+echo ""
+
+# 5. Exchange Authorization Code for Tokens
+if [ -n "$AUTH_CODE" ]; then
+    echo "5. Exchanging authorization code for tokens..."
+    TOKEN_RESPONSE=$(curl -s -X POST "$BASE_URL/oauth2/token" \
+        -H "Content-Type: application/x-www-form-urlencoded" \
+        -d "grant_type=authorization_code" \
+        -d "code=$AUTH_CODE" \
+        -d "redirect_uri=$REDIRECT_URI" \
+        -d "client_id=$CLIENT_ID" \
+        -d "code_verifier=$CODE_VERIFIER")
+    
+    echo "$TOKEN_RESPONSE" | jq '.' || echo "$TOKEN_RESPONSE"
+    
+    ACCESS_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token')
+    REFRESH_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.refresh_token')
+    echo ""
+    
+    # 6. Test UserInfo Endpoint
+    if [ "$ACCESS_TOKEN" != "null" ] && [ -n "$ACCESS_TOKEN" ]; then
+        echo "6. Fetching UserInfo..."
+        curl -s -H "Authorization: Bearer $ACCESS_TOKEN" "$BASE_URL/userinfo" | jq '.' || echo "Failed to fetch userinfo"
+        echo ""
+        
+        # 7. Test Refresh Token
+        if [ "$REFRESH_TOKEN" != "null" ] && [ -n "$REFRESH_TOKEN" ]; then
+            echo "7. Refreshing access token..."
+            REFRESH_RESPONSE=$(curl -s -X POST "$BASE_URL/oauth2/token" \
+                -H "Content-Type: application/x-www-form-urlencoded" \
+                -d "grant_type=refresh_token" \
+                -d "refresh_token=$REFRESH_TOKEN" \
+                -d "client_id=$CLIENT_ID")
+            
+            echo "$REFRESH_RESPONSE" | jq '.' || echo "$REFRESH_RESPONSE"
+            echo ""
+        fi
+    fi
+fi
+
+# 8. Test Client Credentials Flow
+echo "8. Testing Client Credentials Flow..."
+CLIENT_CREDS_RESPONSE=$(curl -s -X POST "$BASE_URL/oauth2/token" \
+    -u "$CONFIDENTIAL_CLIENT_ID:$CONFIDENTIAL_CLIENT_SECRET" \
+    -H "Content-Type: application/x-www-form-urlencoded" \
+    -d "grant_type=client_credentials" \
+    -d "scope=read write")
+
+echo "$CLIENT_CREDS_RESPONSE" | jq '.' || echo "$CLIENT_CREDS_RESPONSE"
+echo ""
+
+echo "================================"
+echo "Testing Complete!"
+echo "================================"