EmbedAuth Blog
Deep, opinionated writing on OAuth, JWT, passwordless flows, session design, and the architectural choices behind production auth systems.
Security
The events every auth system should log, the schema that makes them queryable, why application logs are not an audit trail, tamper-evidence and retention, and how to expose logs to customers without leaking other tenants' data.
Security
Why bots register for your product, why CAPTCHA is the wrong first move, and a layered signup defense — honeypots, timing, disposable-domain policy, invisible attestation, progressive trust, and measuring the friction you're adding.
Security
How stuffing attacks are actually run in 2026 — combo lists, residential proxies, config files and solver services — and the layered defenses that work, from breached-password checks to risk scoring and the metrics that reveal an attack in progress.
JWT
A practical guide to claim design — the standard claims and how to validate them, why token bloat becomes a 431 outage, PII and privacy in a base64 payload, namespacing custom claims, and versioning a payload you can never fully migrate.
JWT
The real trade-off is where authorization state lives and how fast it can change. A decision framework covering revocation latency, introspection, hybrid designs, and the failure modes each choice hands you.
JWT
How JWKS and the kid header make key rotation a non-event — the overlap window, caching and thundering herds, emergency revocation, and the specific mistakes that turn a routine rotation into an outage.
OAuth & OIDC
RFC 8693 explained — how token exchange solves the confused deputy problem in microservices, the difference between delegation and impersonation, act and may_act claims, and when a simpler answer is better.
Multi-Tenant Auth
What enterprise customers mean by \"require SSO,\" how domain verification works and why it's dangerous, what happens to existing passwords and personal accounts, service accounts, and the admin lockout you must design against.
OAuth & OIDC
Google, Apple, GitHub, Microsoft, Facebook and LinkedIn all implement OAuth differently enough to break your assumptions. A field guide to the deviations that cost real debugging time, and the abstraction that survives them.
Multi-Tenant Auth
Roles, permissions, attributes, and relationships — how each model breaks, the role explosion problem, where the policy decision point belongs, and a migration path that doesn't require rewriting every authorization check.
OAuth & OIDC
How to design a scope taxonomy that survives five years of product growth — granularity, naming, incremental authorization, consent screen copy, and the downgrade and revocation paths most APIs never build.
React Auth
The refresh interceptor everyone writes, and the five bugs it has — thundering herds, cross-tab races, retrying non-idempotent requests, background tabs, and the logout that discards a half-written form.
Authentication
What a device trust token actually is, why fingerprinting is the wrong primitive, how to scope MFA skipping safely, revocation and the active-devices list, and the failure modes that silently degrade your second factor into a decoration.
React Auth
The App Router changed where authentication runs. Layouts that don't re-render, middleware that shouldn't authorize, the client/server boundary and what leaks across it, streaming and Suspense, and why every route must check for itself.
Authentication
The data model and security rules for linking social, SSO, and password identities to one user — automatic vs manual linking, the trusted-email trap, unlinking rules, and how to merge two accounts that were never meant to be separate.
Passwordless
A staged migration plan for products that already have millions of passwords — dual-mode auth, the account-recovery trap, when to offer versus enforce, measuring adoption honestly, and the long tail you will never fully convert.
Authentication
Password reset is the highest-value attack surface in most applications. A complete design — token handling, enumeration resistance, host header poisoning, session invalidation, and the failure modes that turn recovery into takeover.
Passwordless
A deliverability guide written for engineers who ship magic links and OTPs — SPF, DKIM, DMARC, why transactional mail needs its own subdomain, greylisting, content that trips filters, SMS toll fraud, and the metrics that show the truth.
Authentication
Why email verification exists, what it genuinely proves, the four flow designs and their trade-offs, token security, deliverability, and the blocking-vs-nagging decision that quietly shapes your activation rate.
Authentication
How refresh token rotation works, why token families enable automatic breach detection, the reuse-detection algorithm step by step, and the edge cases that trip teams up.
OAuth & OIDC
A clear comparison of SAML and OpenID Connect for single sign-on — how each works, XML vs JSON, where they fit, and what B2B SaaS teams should support for enterprise customers.
React Auth
How browser privacy changes — Safari ITP, Chrome's Privacy Sandbox, storage partitioning — broke cookie-based iframe authentication, and the token-by-message pattern that replaces it.
OAuth & OIDC
A practical comparison of popup-based and full-redirect OAuth flows — UX, state preservation, mobile and browser quirks, security trade-offs, and how each behaves inside an embedded iframe.
OAuth & OIDC
PKCE explained step by step — the authorization-code interception attack it prevents, how the code verifier and challenge work, and why it's now mandatory for every OAuth client.
Security
How to design rate limiting for login, OTP, and reset endpoints — algorithms, what to key on, lockout strategies, and avoiding the traps that let attackers through or lock out real users.
Authentication
Stateful sessions vs. stateless tokens, cookie security flags, refresh token rotation, idle and absolute timeouts, and how to revoke access when it matters.
Passwordless
What passkeys actually are, how WebAuthn works under the hood, why they resist phishing where passwords and OTPs fail, and how to adopt them without locking users out.
Multi-Tenant Auth
How to model organizations, users, roles, and isolation when one user can belong to many tenants — and the architectural decisions that are painful to reverse later.
Security
Credential stuffing, broken session handling, JWT confusion attacks, account enumeration, and the other ways login systems get broken in production — plus the concrete fixes for each.
Authentication
Embedded authentication keeps users in your product when they sign in, instead of bouncing them to a third-party domain. Here's how it works, what it changes, and the tradeoffs you sign up for.
OAuth & OIDC
OAuth 2.0 explained without the marketing copy — what the redirects are really doing, where the tokens come from, what PKCE protects against, and the parts the spec doesn't make obvious.
JWT
A JWT is three base64-encoded strings separated by dots. What's in them, how signatures actually work, why "stateless auth" is a half-truth, and the mistakes that keep showing up in production code.
Passwordless
Both replace passwords with email. Both feel "passwordless." They are not the same product. Here's the honest comparison — UX, security, deliverability, and the situations where each one is the wrong choice.
React Auth
Iframe-based auth looks like a clean way to embed a sign-in form. The browser thinks otherwise. Here's what actually breaks — cookies, postMessage, ITP, focus, autofill — and the patterns that survive contact with real users.