Tag
All topics →Everything tagged oAuth.
6 stories, newest first.
Latest
MCP's July 2026 spec rewrite went stateless and made Client ID Metadata Documents the standard, not audience-bound tokens, which have been mandatory since mid-2025. What actually changed since December 2025, and the checklist that replaces the old one.
Read the article
JWT versus opaque tokens for API authentication: statelessness versus revocation, latency at global scale, blast radius, and the hybrid pattern most large deployments use.
We cancelled Auth0 over a year ago. Not because it stopped working, but because scaling to 350,000 monthly active users made the pricing model untenable.
Vercel breached after attacker compromised Context.ai, hijacked an employee's Google Workspace via OAuth, and accessed customer API keys and environment
A comprehensive developer guide to implementing secure authentication in modern applications. Covers OAuth 2.
🚨 ShinyHunters compromised Google, Qantas & dozens more using OAuth device flow attacks, bypassing MFA without exploiting a single software bug.
