Blog

Every line has a literal answer and a real question behind it. Here is what the buyer is actually checking, which answers you can buy, and the three you cannot fake.

Envelope encryption, data keys, and why your sensitive data never has to leave your infrastructure

Both ship SSO, SCIM and audit logs now. The comparison that decides enterprise deals has moved to the long tail: provider coverage, where user lifecycle actually starts, and who is contractually on the hook.

The CLI gets you signed in. This is the session layer underneath it: what the sealed cookie holds, how to refresh it inside a before_action, and the three dashboard settings that break logout in production.

Sierra's MCP gateway iceberg is a field report on agent auth: identity, per-tool scopes, consent, and audit are the submerged mass, and they ship off the shelf.

The side effects nobody documents: analytics, lifecycle email, feature flags, webhooks, and the background job that runs as the wrong person an hour later.

How Neon used auth.md to let agents provision bounded database projects before a human signs up, then later transfer them to people who want to keep them.

Generic OIDC connections meet identity providers that read the same spec differently. Here are the per-connection compatibility settings we added, and why.

The consent screen is no longer where access gets decided. Here is what replaced it, and what your MCP server now has to validate.

It is the one standard that can end a session your app already issued, it has been final since 2022, and almost nobody implements it. Here is the whole mechanism, the validation your endpoint owes, and the two limitations the spec admits to itself.

What actually happens when a user is removed: the event your app receives, the directories that never send one, and how to catch what gets dropped.

We checked the roundups' claims against all three vendors' own pricing pages, using one test: can your customer's IT admin configure SSO and SCIM themselves, on the plan you already pay for?

Enabling SSO is a dashboard toggle. The real work is the organization model, self-service configuration, and the traps that surface after your first enterprise customer.

Okta, Auth0, and Descope all shipped Cross App Access between August 24 and September 1. The two-layer pattern underneath it outlasts whichever vendor wins.

Codex extra credits price out to exact API list rates, and we measured the credit lane 1.5x slower at quality we couldn't tell apart. Overflow to the API.