Install
Identity, Auth & Access
OAuth/OIDC, SSO, policy engines, and permissions at scale.
- 8 Tracked terms
- Last 30 days Feed window
What this topic collects on
An article joins this feed when it matches these terms. Each one is also a search of its own.
Related topics
Latest in Identity, Auth & Access
5 JWT Mistakes That Quietly Break Your Auth Security
1+ day, 21+ hour ago (458+ words) JWTs are everywhere — API auth, SSO, session management — because they're simple to generate and easy to pass around. That simplicity is also exactly why they get misused. A JWT can be perfectly well-formed, verify correctly, and still be a security…...
Your JWT Tokens Are Not Encrypted. Anyone Can Read Them.
12+ hour, 34+ min ago (976+ words) Open your browser console right now. No secret key. No hacking tool. No special library. That string above is a real JWT payload. It contains a user ID, a role, and an email address. Anyone who intercepts that token can…...
Moca Chain mainnet is live: a Layer 1 built for privacy-preserving identity for businesses and AI agents
22+ hour, 41+ min ago (737+ words) Moca Chain mainnet is live: an EVM-compatible Layer 1 blockchain for privacy-preserving digital identity, verifiable credentials and AI agents, with AIR as its business integration layer. Moca Network has launched Moca Chain mainnet, an EVM-compatible Layer 1 blockchain purpose-built for digital identity…...
MCP connection errors explained: 404 on /sse, 406 Not Acceptable, session 400s, 402
14+ hour, 12+ min ago (410+ words) What each MCP Streamable HTTP error means and the fix: 404 on /sse, 406 Not Acceptable, 415, session 400s, 405 on GET, x402 402 quotes, timeouts. Tagged with mcp, ai, api, debugging. MCP Streamable HTTP is one URL. The client POSTs JSON-RPC to it and may open…...
MCP Python SDK Flaw Exposed OAuth Credentials to Account Takeover
1+ day, 5+ hour ago (270+ words) Security researchers at Cycode uncovered a vulnerability in Anthropic’s Model Context Protocol (MCP) Python SDK that could allow a malicious MCP server to steal OAuth credentials and potentially take over user accounts. The vulnerability, detailed in new research from Cycode,…...
How to get a Firebase ID token for testing your API (without writing a script)
23+ hour, 2+ min ago (188+ words) Your backend verifies Firebase ID tokens. You want to call it from curl or Postman as a specific user. Firebase gives you no button for that. The usual answers are a sign-in REST call with an email and password (only…...
What Is PKCE, How It Works & Flow Examples
23+ hour, 21+ min ago (810+ words) This blog was originally published on Descope. You'd think the most secure OAuth flow wouldn't need a patch, but the standard Authorization Code flow has a blind spot. It can't guarantee that the app redeeming an authorization code is the…...
Build vs Buy: Authentication in 2026 (Auth0, Clerk, Supabase Auth, or Roll Your Own)
23+ hour, 21+ min ago (500+ words) I've shipped all four approaches at different times, and the mistake I made early was treating this as a code decision. It's an operations decision. Below is the framework I use now, the concrete trade-offs, and the failure modes each…...
JWTs Fail Validation for Some Requests but Not Others: Clock Skew, `nbf`, and How Much Leeway Is Safe
23+ hour, 21+ min ago (464+ words) Three claims in a JWT are compared against the validator's clock: The same offset in the other direction eats the tail instead: the validator's clock runs ahead and tokens get rejected as expired early. With short-lived access tokens (60–300 seconds is…...
What Is OAuth Token Exchange?
23+ hour, 21+ min ago (759+ words) This blog was originally published on Descope. This post explains how OAuth Token Exchange works, the distinction between its two core patterns (impersonation and delegation), when to use it, and what to consider when implementing it. Several optional parameters shape…...