Identity guides

PKCE explained: how it protects the authorization code

How Proof Key for Code Exchange works, why S256 and not plain, why confidential clients should use it too, and the errors that quietly disable it.

How to implement the OpenID Connect authorization code flow

A practical walkthrough of OpenID Connect sign-in: discovery, the authorization request, the code exchange, and the ID token checks that are not optional.

OAuth and OpenID Connect for single-page apps: where tokens should live

Why the implicit flow is out, why a backend-for-frontend is the safest pattern for SPAs, and the trade-offs of keeping tokens in the browser.

Refresh token rotation and reuse detection, explained

How rotating refresh tokens on every use turns a stolen token into a detectable event, how token families work, and the race conditions to plan for.

DPoP implementation guide: sender-constrained tokens without mTLS

How DPoP proofs are built and checked, what the jti, htm, htu, ath and nonce claims are for, and the server-side checks that make it more than decoration.

OAuth token exchange (RFC 8693) for delegation and impersonation

When to use token exchange, the difference between delegation and impersonation, the act claim, and how to keep exchanged tokens narrower than the original.

Service-to-service authentication with the client credentials grant

How the OAuth client credentials grant works, how to authenticate the client, how to scope and rotate secrets, and when to prefer key-based client auth.

How to validate a JWT access token in your API

The checks an API must run on a JWT access token — signature, algorithm, issuer, audience, expiry, type — and when introspection is the better choice.

JWT vs opaque access tokens: which should you use?

The real trade-off between self-contained JWT access tokens and opaque reference tokens: local validation versus immediate revocation and data exposure.

Logout in OpenID Connect: RP-initiated, front-channel and back-channel

Why signing out is harder than signing in, how RP-initiated and back-channel logout work, and how to make revocation reach every application.

Passkeys for developers: how WebAuthn sign-in works

How passkey registration and authentication work under WebAuthn, why they resist phishing, synced versus device-bound passkeys, and account recovery.

The OAuth device authorization flow for TVs, CLIs and IoT

How the device authorization grant lets an input-constrained device or CLI sign a user in via a second screen, and the phishing risk to design around.

OAuth and OpenID Connect for native and mobile apps

Why native apps must use the system browser rather than an embedded web view, which redirect URIs to use, and why PKCE is mandatory (RFC 8252).

SAML SSO for B2B SaaS: what enterprise customers will ask for

How SAML 2.0 single sign-on works for a B2B product, SP- versus IdP-initiated flows, per-tenant configuration, and the assertion checks that matter.

SCIM provisioning explained: automating user lifecycle for B2B

How SCIM 2.0 lets a customer's directory create, update and deactivate users in your product, which endpoints matter, and why deprovisioning is the point.

Session management best practices for web applications

Session IDs, cookie flags, idle and absolute timeouts, regeneration on login, and revocation — the controls OWASP and NIST expect, and why each exists.

Session fixation and session hijacking: how they work and how to stop them

The difference between fixing a victim's session ID and stealing it, and the specific controls — regeneration, cookie flags, binding — that defeat each.

Token theft and replay: how bearer tokens are stolen and how to limit the damage

Where access and refresh tokens leak from, why bearer tokens are replayable by design, and the layered defences: short lifetimes, rotation, sender-constraining.

MFA methods compared: SMS, TOTP, push, email codes and passkeys

Which second factors resist phishing and which do not, what NIST SP 800-63B says about SMS and OTPs, and how to choose MFA for a multi-tenant product.

What makes authentication phishing-resistant?

The technical property that makes an authenticator phishing-resistant — verifier-name binding — why codes and push fail it, and what passkeys change.

Step-up authentication: asking for more proof only when it matters

How step-up authentication works with OpenID Connect acr and max_age and the RFC 9470 challenge, and which actions deserve a fresh proof of identity.

Defending login against credential stuffing and password spraying

How automated login attacks work and the layered controls that stop them: MFA, breached-password checks, rate limits, and enumeration-safe responses.

Designing account recovery that is not the weakest link

Password reset tokens, what to revoke after a reset, why recovery bypasses MFA so often, and how to keep recovery as strong as sign-in.

An OAuth 2.0 and OpenID Connect security checklist

A condensed, sourced checklist from RFC 9700 and OpenID Connect Core for reviewing an OAuth or OIDC integration, client or server side.

Build vs buy authentication: an honest decision framework

What building authentication in-house really involves — protocols, sessions, recovery, MFA, isolation, on-call — and when building is the right call.

How to migrate from one identity provider to another

A step-by-step plan for moving users, password hashes, sessions and integrations between identity providers without forcing everyone to reset.

Security questions to ask an identity provider (and what good answers look like)

The questions a security reviewer should ask any identity vendor about isolation, sessions, tokens, keys, incidents and certifications — with what to look for.

Hosted login page or custom login UI: how to choose

The security and product trade-offs between redirecting to a hosted login page and building your own sign-in screen against an identity API.