First, we build from source and run the test script to ensure that everything fits together.

Next, we will test the protected discovery server's API and web page.

After that, we will learn how to acquire access tokens using OAuth 2.0 client credentials and authorization code grant flows.

With the issued access tokens, we will test the protected APIs. We will also verify that an access token issued for a reader client can't be used to call an updating API.

Finally, we will also verify that Swagger UI can issue access tokens and call the APIs.