Authorization Is a Runtime Decision
See how an agent request becomes an allowed or denied tool action through identity context, policy checks, scoped credentials, and an auditable decision trail.
Loading…
Topic
Authentication
229 posts about Authentication. Every summary links to the original.
- 229 posts
- 29 companies
- 5 explainers
See the idea
Authentication explainers
Axum at the Trust Boundary: From Request to Protected Response
Axum is a Rust web framework for composing routes, middleware, and extractors. This explainer shows how different login flows become verified identity before a handler responds.
The Token’s Route: From Auth0 Login to API Authorization
See how an Auth0 login becomes an API decision: redirect the user, issue the right token, validate its claims, and apply audience, scope, and access policies.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Supabase Alpha September 2020
Seven months into development, Supabase announced a series of platform updates across authentication, database tooling, and client libraries. The release introduced OAuth logins supporting Bitbucket, GitHub, GitLab, and Google, alongside table cloning and one-click Postgres extension management. In the SQL editor, users can now save favorite queries and access locally stored query histories directly within the browser. The web dashboard adopted Next.js automatic static optimization for improved responsiveness, while postgrest-js migrated to TypeScript and an isomorphic gotrue-js TypeScript library was built for Netlify GoTrue integration. Supabase is prioritizing a transition from Alpha to Beta by tracking open-source tool performance in a dedicated benchmarks repository.
Supabase Alpha August 2020
Six months into developing its hosted database platform, Supabase announced updates focusing on authentication, table view management, and community developer tooling. Users can now create database tables and columns directly from the table view interface as well as invite team members to their organizations. The authentication system introduced configurable email confirmations for new user registrations, allowing administrators to toggle confirmations and edit email templates directly from the dashboard. Community contributors added TypeScript support to Supabase, implemented UMD support in supabase-js, and began building Python client libraries starting with postgrest-py. Supabase is preparing to transition from Alpha to Beta by stabilizing its Auth API, improving dashboard performance, and benchmarking platform systems.
Securing and Managing Multi-cloud Presto Clusters with Grab’s DataGateway
Grab's data engineering team needed to manage data access across growing Presto workloads spanning hundreds of users, thousands of tables, and multiple clouds without exposing infrastructure churn to clients. Out-of-the-box Presto lacked fine-grained schema- and table-level access controls, unified endpoint routing, and seamless cluster switching. To solve this, the team built DataGateway, a smart HTTP proxy and abstraction layer deployed as microservices on Kubernetes. The platform parses incoming SQL statements, verifies user access control lists against target schemas and tables, and dynamically routes queries to appropriate AWS or Azure Presto clusters without requiring endpoint updates. This architecture enabled zero-disruption cluster migrations across 40 clusters and unified access management across a multi-cloud data lake environment.
Supabase Auth
Following an early community launch on Hacker News, the open-source Firebase alternative Supabase faced heavy developer demand for a dedicated authentication and authorization solution. In response, the team evaluated existing open-source tools such as KeyCloak and Kratos before landing on an architecture combining a forked Netlify GoTrue server with PostgreSQL and PostgREST. The resulting Supabase Auth system provides client methods like signUp and signIn alongside authorization powered by PostgreSQL Row Level Security and policies. By leveraging SQL policies to enforce access rules directly in the database, developers avoid repetitive middleware filtering while maintaining granular access controls. Future roadmap plans include adding third-party OAuth providers, custom email templates, and simplified policy management interfaces for non-technical users.
Supabase Alpha July 2020
Supabase announced the release of Supabase Auth following five months of development, providing resources and a video tutorial on implementing authentication with PostgreSQL Row Level Security. The Table Editor now allows users to drill multiple levels deep into table relationships as well as add, delete, and download rows directly. Newly created projects also include access to additional Postgres extensions, including pgsql-http, pgjwt, plpgsql_check, and pljava. Further platform updates include an or filter in the client library, expanded capabilities for the postgres-meta REST management server, and persistence for open tabs in the Table View. Additionally, the auto-generated documentation now integrates authentication guides, and visual page transition glitches have been resolved.
Developer Platform updates Spring 20'
Zoom introduced several updates across its developer platform alongside new roadmap milestones for 2020. Marketplace enhancements include a Developer Dashboard tracking install numbers and API usage, as well as dynamic OAuth scope configurations that distinguish mandatory and optional permissions. For client development, the WebSDK adds Microsoft Edge Chromium compatibility with video and VOIP support, whereas the iOS SDK incorporates Xcode 11 support. Due to increased developer demand, Zoom updated its V2 REST API rate limits and delivered new chat webhooks tracking message, channel, and member activity. Upcoming platform initiatives include the permanent termination of all legacy V1 APIs on May 31, 2020, platform security enhancements, and an iframe-free JavaScript embedding framework for the WebSDK.
Backwards Incompatible V2 API Changes
Following the removal of Zoom's Attention Tracking feature, backwards-incompatible modifications were introduced to the V2 REST API effective April 3, 2020. Under these deprecations, the attentiveness_score field in meeting and webinar participant reports returns an empty value, while the attention_tracking field across user, group, and account settings endpoints defaults to false. Both attention-tracking fields remain temporarily in API responses before full removal in a future release. Additionally, starting April 12, 2020, password-related configuration fields become immutable and permanently set to true for Free and single-host Pro K-12 Education accounts. These locking measures affect settings such as password requirements for scheduled, instant, or personal meetings, alongside PSTN password protection across account, group, and user endpoints.
How to Implement a Secure Central Authentication Service in Six Steps
Shopify built Identity to reduce the overhead of managing separate staff accounts across multiple stores, where each Shop isolated user data and lacked single sign-on. The service uses OpenID Connect (OIDC) to centralize authentication while retaining destination-specific authorization, and it models legacy one-store accounts separately from Identity accounts that can access multiple destinations. Migration begins by synchronizing profile and security data, routing authentication through Identity, and prompting eligible users to verify email ownership, combine accounts, and provide required 2FA credentials. Single legacy accounts can be auto-upgraded without changing their UUID, while multi-account merges use a MergeSession and operations implemented with ActiveOperation; WebAuthn also supports physical security keys as a second factor. Finally, Shopify changed store signup and staff invitations to prevent new legacy accounts, reporting that more than 75% of active accounts had been upgraded or combined at the time of writing.
Migrating Existing Datastores
Grab's Identity team faced imminent memory exhaustion on a single Redis node used to cache mobile authentication tokens under rapid user growth. Because read traffic outweighed write traffic by roughly 200 times, the team opted for an AWS ElastiCache cluster with three shards and two read replicas per shard. They executed a zero-downtime, six-phase migration plan while handling a peak load of 20,000 queries per second. The migration transitioned through initial one-time data replication, asynchronous shadow writes, synchronous dual writes, asynchronous read validation, switching primary reads, and final write cleanup. Controlled by feature flags and monitored with metrics at every stage, the migration completed without invalidating tokens or causing service disruptions.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.