Blog

How a new IETF draft extends OAuth so AI agents can act for users with explicit consent and a clean audit trail.

Everything you need to know to implement and validate JWTs securely in Ruby: from creating JWTs, to signing and verifying them with JWKS, handling custom claims, and best practices you should be following.

How OAuth breaks down when AI agents spawn other agents, and what IETF drafts are doing about it.

Agent identity is no longer experimental. NIST's February 2026 announcement made it enterprise-critical.

A practical comparison across features, pricing, reliability, and what enterprise buyers actually grade you on.

What it really takes to sell to the U.S. government, from the teams who have been through it.

AI agents are reading your documentation. Here's what WorkOS did to serve them clean markdown instead of unparseable HTML.

Identity, authorization, and oversight patterns for systems that act on their own.

Master Spring Security authentication from form login and JWT to enterprise SSO, with production-ready patterns across Spring Boot, Quarkus, and Micronaut.

Build a Node app that lets users connect Notion and list their pages with a refreshed access token, without implementing OAuth.

An opinionated checklist for the auth decisions you'll actually have to make.

Picking a library, choosing where to verify, and avoiding the mistakes that quietly break security.

Stytch works, until your enterprise deals outgrow it. Here's what to use instead.

A practical walkthrough of RFC 9449 for engineers: the proof JWT, server-issued nonces, key storage in the browser, and where DPoP fits next to mTLS.

How LLMs leak data, get hijacked, and turn friendly inputs into exploits, and why most of the defenses live outside the model.