#OAuth
Delegation Done Right: Token Exchange and the On-Behalf-Of Pattern
Storing user credentials, forwarding tokens verbatim, or forcing constant re-authentication are the three ways teams get agent delegation wrong. Learn how OAuth 2.0 Token Exchange (RFC 8693) and JWT Bearer assertions (RFC 7523) solve it correctly.
Agent Identity: Why Your AI Agent Needs to Be a First-Class Principal
Giving an AI agent the user's token or a shared service-account credential collapses least privilege and attribution. Learn why an agent needs to be a distinct, first-class principal — and how RFC 8693's act claim already models it.
The Authentication and Authorization Challenges of Agentic AI
Agentic AI breaks the two-actor identity model everything else was built on. This pillar post maps the seven authentication and authorization gaps — identity, delegation, consent, trust chains, tool surfaces, data scope, and governance — that the rest of the series covers one at a time.
Users Getting Logged Out Randomly? Your Refresh Token Rotation Might Be Fighting Itself
Refresh token rotation can log users out with no clear cause. Learn why reuse detection fires against your own legitimate traffic, and how to fix it for SPAs, mobile apps, and server-rendered applications.
OpenID Connect and OAuth2 Standard Scopes
OpenID Connect and OAuth2 define a set of standard scopes that can be used to control the level of access that a client application has to a user's resources. In this blog post, we will explore the standard scopes defined by OpenID Connect and OAuth2 and understand their significance in the authorization process.
OpenID Connect Introduction
OpenID Connect, build on the OAuth 2.0 protocol, emerges as a robust solution to handle user authentication across platforms and applications. Learn more about OpenID Connect and its components.
JWT or Opaque Token : What is the best choice for M2M?
JWT or Opaque Tokens can serve both as authentication mechanisms for Machine to Machine (M2M) communications. But what is the best choice between each solution?
What is the difference between Authentication, Application authorization and Access Control?
We'll delve into the distinctions between authentication, authorization, and fine-grained authorization, clarifying their roles and importance in safeguarding sensitive information and resources.
Generate RSA Key Pairs with OpenSSL for signing JWT
This guide will take you step by step for generating RSA key pair using OpenSSL for signing JWT.
How to Invalidate a JWT Access Token?
While JWTs are essential for secure communication between clients and servers, managing their lifecycle and ensuring their security can be challenging. In this blog post, we'll explore best practices for invalidating access tokens, including token revocation and rotation, and how to implement these mechanisms in OAuth2 and OpenID Connect.
Understanding OpenID Connect and OAuth2 Grant Types
This article provides a comprehensive guide to understanding the different grant types used in OpenID Connect and OAuth2 protocols.