Practical writing on OAuth2, OpenID Connect, passkeys, and token security: the problems you hit at 2am, not the happy path.
·5 min read
OAuth assumes the authorization server knows a client before it shows up. MCP clients break that assumption. Client ID Metadata Documents fix it: the client_id is an HTTPS URL, and the document behind it is the registration. Here's how the flow works and what to check.
·4 min read
SMS one-time codes cost money on every attempt. Turning the flow around, so the person sends the code from WhatsApp, makes phone-number sign-in free and unlimited. Here is how it works and where its limits are.
·4 min read
An MCP server plays two different roles in OAuth: the API an MCP client connects to, and, sometimes, a client calling other APIs as the user. Mixing them up leads to token passthrough or a shared service key. Here's how to tell them apart.
·4 min read
Partner and internal API docs usually end up behind a shared password or a VPN. Here's where the common approaches leak, and what gating a reference on your existing login looks like instead.
·4 min read
Sending users to a vendor subdomain to log in costs you trust and complicates cookies. Here's what changes when you map a custom domain, and what the setup actually involves.
·5 min read
Your token looks fine, decodes cleanly, and still fails verification. Here are the eight things that actually cause it, in the order worth checking them.
·3 min read
OAuth2 is authorization, OIDC is authentication built on top of it. Here's what that means concretely, and why using an access token to identify a user is a real vulnerability.
·3 min read
PKCE is not just for mobile apps anymore. Here's the concrete attack it prevents, why the client secret doesn't save you, and why the spec now recommends it for every OAuth2 client.
·4 min read
TOTP and SMS codes make phishing harder. Passkeys make it structurally impossible. The difference is origin binding, and it's worth understanding before choosing.
·3 min read
The error says the URI doesn't match a registered value. Matching is exact string comparison, which makes the causes narrow and mostly invisible: trailing slashes, ports, casing, and encoding.
·4 min read
Rotation plus reuse detection is the right design. It also logs users out at random if your client can fire two refreshes at once: here's why, and the two ways to fix it.
·4 min read
localStorage, cookies, memory, or a backend-for-frontend. Every option trades XSS exposure against CSRF exposure and complexity: here's the actual tradeoff rather than the usual dogma.
·4 min read
Key rotation fails when the new key starts signing before consumers have seen it. The fix is an overlap window sized by your cache TTL and token lifetime: here's the sequence.
·4 min read
OAuth2 scopes answer what an application may do. Roles answer what a user may do. Neither answers whether this user may edit that specific document, and cramming it into a token is how you get 8KB headers.
AuthAction handles token issuance, rotation, JWKS, passkeys, and enterprise SSO, so most of what we write about here stops being your problem.
Free, unlimited users. No credit card required.