Engineering

OAuth vs OIDC: The Difference in One Claim

There's a code pattern that appears in production systems everywhere, written by competent engineers, that reliably produces a complete authentication bypass:

Engineering

OAuth Flows: When to Use What

OAuth isn't one flow, it's a small family of them, and picking the wrong one for your application type is one of the most common ways teams end up with a security gap they didn't know they'd introduced. The right flow depends almost entirely on one question: what kind of application is asking for ac

Engineering

OAuth Didn't Make Authentication Complicated. It Made It Safe.

Ask a developer who's spent a frustrating afternoon debugging a redirect URI mismatch what they think of OAuth, and you'll usually get some version of the same complaint: too many parameters, too many steps, too many ways to get it subtly wrong. State, nonce, PKCE, scopes, grant types, token types,

Engineering

OAuth, Demystified: The Hotel Key Card Explanation

Most explanations of OAuth start with a sequence diagram full of boxes labeled "Resource Owner" and "Authorization Server," which is accurate and almost useless if you're trying to build an intuition for what's actually happening. Here's a version that starts with something everyone already understa

Engineering

OAuth Client Authentication: Six Methods and When Each Wins

Every OAuth deployment makes a decision about how clients prove who they are, and in most deployments the decision was made by whichever tutorial the first integrating engineer found. That's how you end up with client_secret_post everywhere, a spreadsheet of secrets, and a compliance finding four ye

Engineering

Non-Human Identity Is Now the Majority of Your Identities

Start with a counting exercise. It takes ten minutes and usually ends an argument.

Engineering

Nobody Plans to Build an Identity Platform. Yet Almost Every SaaS Company Does.

Somewhere in your codebase there's a folder called auth. It probably started as a weekend's work — a users table, bcrypt, a session cookie, maybe a JWT if whoever wrote it had opinions. Nobody scheduled a design review for it. It wasn't on the roadmap as "build an identity platform." It was a login

Engineering

Multi-Region Identity: Latency, Consistency, Residency — Pick Two

Most distributed systems get to be hard in one dimension at a time.

Engineering

Migrating Password Hashes Without Resetting Every User

The query that starts this project is four lines long:

Engineering

Migrating Off an Identity Provider Without Downtime

Nobody plans this project. It arrives — a provider gets acquired and the roadmap changes, pricing moves somewhere the finance team won't follow, a compliance requirement lands that the current platform can't satisfy, or the architecture stopped fitting three years ago and everyone finally admits it.

Engineering

If You Already Have MCP, Do You Actually Need A2A?

There's a genuine debate happening right now among people building agentic systems, and it's worth having honestly rather than resolving it with a hot take. MCP (Model Context Protocol) gives an agent a standardized way to discover and call tools. A2A (Agent-to-Agent protocol) gives an agent a stand

Engineering

MCP, Explained: It's a Resource Server With a Different Kind of Visitor

If you've built or secured a regular API, you already understand resource servers: the thing that holds the data, checks an incoming token, and decides whether to hand the data over. An MCP server is that same idea, aimed at a different kind of visitor — not a browser tab or a mobile app operated by