Blog
OAuth in practice
What we learned building an authorization server, written down while it is still fresh. The posts cover protocol decisions, the traps that cost us a day, and the operational questions the reference documentation does not answer.
Subscribe with the feed, or read the getting started guide if you would rather try the server than read about it.
An agent's connect link must check who opens it
An agent hands a person a link to connect an account. If the link works for whoever opens it, a forwarded link connects the wrong account to the wrong agent.
Half of IPSIE SL1 cannot be a default
IPSIE SL1 is the OpenID Foundation's enterprise sign-in profile. Half of it belongs in every server; the other half breaks other standards. When to use it.
Deactivating a user does not end their access
A flag checked at the next sign-in leaves every session and token alive. How to end access at once, in what order, and what stays out of reach.
Okta Universal Logout is an expired draft
Okta Universal Logout follows a draft no working group adopted, and it has expired. What Okta sends, the nbf timing trap, and checks no setting can relax.
What Entra and Okta send to a SCIM server
A SCIM server that follows the standard's strict profile refuses the requests Entra and Okta send every day. Which requests, and why one setting is enough.
Your MCP server must check who a token is for
MCP authorization in plain terms: what your MCP server must publish, which token field must name it, and two questions the spec leaves to you.
Your rate limiter won't stop password guessing
A limit per IP address stops request floods, not password guessing. What a sign-in throttle has to count, where to keep the count, and four mistakes I made.
What DPoP protects you from, and what it doesn't
A leaked access token works for anyone who finds it. DPoP ties it to a key the client keeps. What that stops, what it costs, and when I would skip it.