OAuth 2.0, OpenID Connect, PKCE, and federated identity in depth.
RFC 8693 explained — how token exchange solves the confused deputy problem in microservices, the difference between delegation and impersonation, act and may_act claims, and when a simpler answer is better.
Google, Apple, GitHub, Microsoft, Facebook and LinkedIn all implement OAuth differently enough to break your assumptions. A field guide to the deviations that cost real debugging time, and the abstraction that survives them.
How to design a scope taxonomy that survives five years of product growth — granularity, naming, incremental authorization, consent screen copy, and the downgrade and revocation paths most APIs never build.
A clear comparison of SAML and OpenID Connect for single sign-on — how each works, XML vs JSON, where they fit, and what B2B SaaS teams should support for enterprise customers.
A practical comparison of popup-based and full-redirect OAuth flows — UX, state preservation, mobile and browser quirks, security trade-offs, and how each behaves inside an embedded iframe.
PKCE explained step by step — the authorization-code interception attack it prevents, how the code verifier and challenge work, and why it's now mandatory for every OAuth client.
OAuth 2.0 explained without the marketing copy — what the redirects are really doing, where the tokens come from, what PKCE protects against, and the parts the spec doesn't make obvious.
Authentication
Foundations, flows, and patterns for user authentication on the modern web.
BrowseJWT
Tokens, signatures, claims, and the things that go wrong with JWTs.
BrowseSecurity
Threats, mitigations, and defensive design for auth systems.
BrowsePasswordless
Magic links, OTPs, passkeys, and what to use when.
BrowseReact Auth
Authentication patterns specific to React and SPAs.
BrowseMulti-Tenant Auth
Designing auth for B2B SaaS — orgs, roles, and isolation.
Browse