Engineering
Token Exchange (RFC 8693): The Grant Type Nobody Teaches
Somewhere in your architecture there is a service that holds a token it should not be using.
Latest
Engineering
The Magic Behind Passkeys
Passkeys are explained badly almost everywhere. The usual description — "you log in with your face instead of a password" — isn't merely imprecise, it describes something that isn't happening. Your face is not sent anywhere. It isn't the credential. It's barely part of the protocol.
Engineering
The Lifecycle of an OAuth Client
Every OAuth deployment I've reviewed has a table of clients, and every one of those tables contains at least one row that nobody can explain.
Engineering
The Identity Tax: Why Every Enterprise Customer Costs More Than You Think
The pitch to the board is always the same: land an enterprise logo, and the ACV justifies whatever it took to close the deal. What that math usually leaves out is that the deal doesn't end at signature. It starts a slow-drip tax on the engineering roadmap that doesn't show up on the deal's own P&L,
Engineering
The Identity Platform I Wanted to Exist
Every identity platform I've worked with has asked me to make the same choice, and I've never been convinced the choice is real.
Engineering
The Identity Latency Budget: Where 200 Milliseconds Actually Goes
A user clicks "Sign in." Somewhere between that click and the moment they see their dashboard, they've formed an opinion about your product.
Engineering
The Hidden Cost of Audit Logs
Security teams say: log everything.
Engineering
The Hardest Problem in Identity Isn't Authentication. It's Recovery.
Every security team's threat model has an attacker trying to get in. Almost none of them have the scenario that actually generates the most difficult decisions: a legitimate user, locked out, who is telling the truth.
Engineering
The Great Password Myth: Why Forced Rotation Made Things Worse
For about twenty years, the 90-day password change was one of the least controversial things in enterprise IT. It appeared in every hardening guide, every audit checklist, every onboarding deck. Nobody had to defend it, because nobody attacked it.
Engineering
The Forgotten Side of SSO: Keeping Sessions in Sync
A support ticket from a real category of incident:
Engineering
The Extensibility Trap: Why Every Identity Platform Needs Opinions
Every enterprise deal eventually produces the same sentence, usually about forty minutes into a technical call, usually phrased apologetically:
Engineering
The Confused Deputy Problem Comes Back With Agents
In 1988, Norm Hardy wrote up a bug in a Fortran compiler that ran on a shared university mainframe.