Authorization Is a Runtime Decision
See how an agent request becomes an allowed or denied tool action through identity context, policy checks, scoped credentials, and an auditable decision trail.
Loading…
Topic
Authentication
229 posts about Authentication. Every summary links to the original.
- 229 posts
- 29 companies
- 5 explainers
See the idea
Authentication explainers
Axum at the Trust Boundary: From Request to Protected Response
Axum is a Rust web framework for composing routes, middleware, and extractors. This explainer shows how different login flows become verified identity before a handler responds.
The Token’s Route: From Auth0 Login to API Authorization
See how an Auth0 login becomes an API decision: redirect the user, issue the right token, validate its claims, and apply audience, scope, and access policies.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
How to Carry User Identity Across Federated Kubernetes and AI Platforms
Federated data and AI platforms let users move among portals, datasets, notebooks, and assistants across clusters, but single sign-on alone does not carry trusted identity across control-plane and data-plane boundaries. The post presents a central identity gateway that owns platform sessions through OIDC, a shared session store, stateless data-plane gateways, and an identity-validation API. Regional gateways validate sessions through /gateway/userinfo, enforce local policy, and inject standardized identity headers instead of forwarding raw tokens or independently managing refresh and logout. This separates session ownership from request enforcement, supports consistent logout, and lets assistants pass delegated user identity to backend tools without broad service credentials. At NVIDIA, the approach reduced repeated login events by 55% across internal developer platforms spanning Kubernetes clusters in AWS and OCI, while establishing a foundation for unified platform shells and AI assistants.
Five Reasons Why Your Auth0 Permissions Are Not in your Access Token
Auth0 access tokens can lack a permissions claim despite apparently configured RBAC, and the post identifies five silent causes. The authorization request may omit the API audience, the API’s “Add Permissions in the Access Token” setting may be disabled, or a permission-bearing role may not be assigned to the user, including at the relevant organization level. Developers may also be decoding an ID token rather than the API access token, whose aud identifies the API. Client Credentials tokens represent applications rather than users and typically carry granted scopes instead of a permissions array. For custom Post-Login claims, the post advises using a namespaced claim rather than colliding with Auth0’s reserved permissions claim.
Authenticating TeamCity Builds to External Services With OIDC
Static CI/CD credentials can leak through logs or artifacts, expose uncertainty over who copies them, and require rotation, so the article presents OIDC as an alternative for authenticating TeamCity builds. It explains the workload flow: an identity provider issues a signed JWT whose claims include validity, audience, and issuer, while the consuming service retrieves metadata and JWKS, verifies the signature, and checks those claims. The TeamCity OIDC JWT plugin makes the server an identity provider, supports RSA- or ECDSA-based signing, key rotation, configurable public issuer hosting, and extensions for HSMs or key-management services. After installation from JetBrains Marketplace, build configurations can issue tokens at startup or on demand, with default or fixed five-minute lifetimes, for direct presentation or token exchange with AWS, Google Cloud, and other OIDC services.
When AI takes the wheel: The rise of invisible identity intelligence in 2026
Point-in-time authentication treats an initial password, MFA, or passkey check as sufficient trust for the rest of a session, leaving post-login account takeovers, session hijacking, and risky API actions insufficiently evaluated. The proposed model replaces this front-door assumption with continuous context evaluation using passive telemetry such as network, telecommunications, device, behavioral, and transaction signals, then intervenes when risk scores or policy thresholds rise. For AI agents, delegated authority sets temporal, monetary, and API limits through short-lived credentials, while Know Your Agent lineage links execution to the authorizing human and deploying enterprise. High-impact actions can trigger human checkpoints through SMS, push, or voice channels, while immutable logs, transparent scoring, tenant isolation, and session lineage support auditability and compliance. The resulting architecture aims to keep low-risk autonomous work unobtrusive while making sensitive operations controllable and provable.
Complete guide to sending email to Google: Rules, signals & setup
Sending email to Google requires understanding differences between consumer Gmail and Google Workspace, plus the authentication and reputation signals used by Google’s filtering systems. The guide says SPF and DKIM are required for all senders, while DMARC is required for senders exceeding 5,000 messages per day to Google inboxes; it also gives a bounce example for missing alignment. It recommends keeping user-reported spam below 0.1%, never reaching 0.3%, and providing one-click unsubscribe handling. Google Postmaster Tools reports compliance, spam rate, authentication success, and delivery errors, while the Feedback-ID header enables aggregate complaint analysis by campaign or sender ID. Workspace administrators can apply additional filters, so successful delivery to Gmail does not guarantee placement in a corporate Workspace inbox.
Securing Agentic Commerce
Agentic commerce is moving from AI-assisted product discovery toward purchases completed by agents, but retail systems often cannot reliably establish the shopper’s identity or spending authority. The post describes four phases—product discovery, checkout functions, delegate-to-buy, and agent-to-agent commerce—and notes standards including UCP, ACP, and AP2. Auth0’s approach combines user authentication, asynchronous authorization, and authentication for MCP, using CIMD-based agent registration, OAuth, and on-behalf-of token exchange to issue temporary, scoped transaction access. It presents third-party shopping agents and retailer-owned agents as two deployment models, with actions tied to an authenticated shopper and recorded for auditability. The proposed identity layer can sit alongside an existing identity provider while supporting emerging protocols and future autonomous purchasing.
How to Approve Real Users and Block Fake Accounts at Sign Up with Lookup and Verify in PHP
The tutorial shows how to combine Twilio Lookup and Verify in a PHP sign-up flow that screens phone numbers before sending an OTP. It starts with Line Type Intelligence to accept mobile numbers, optionally checks reachability with Line Status, and uses Identity Match to compare submitted first and last names against authoritative sources without revealing underlying data. If those checks pass, the application sends a six-digit verification code and validates it through a Verify service. The provided implementation uses PHP 8.5, Slim, Twig, Monolog, and the Twilio REST client, with environment flags controlling optional checks and logs recorded in data/app.log. Testing covers mobile, toll-free, VoIP, and name-mismatch cases, while the pricing discussion recommends ordering cheaper checks before more expensive Identity Match and Verify calls.
How to Approve Real Users and Block Fake Accounts at Sign Up with Lookup and Verify
Fake accounts and signup fraud can undermine onboarding, so the tutorial builds a Node.js flow that collects a user's name and phone number. It combines Twilio Lookup and Verify through four progressively intense checks: line type, line status, identity match, and SMS OTP possession. The implementation blocks landline, nonfixed VoIP, toll-free, and pager numbers, checks submitted first and last names against authoritative sources using exact_match or high_partial_match, and sends an OTP only after the lookup steps pass. Line status is optional in the example because access is in Private Beta, while the project uses Express, EJS, and environment variables for its Node.js setup. It also demonstrates expected outcomes for mobile, blocked, and mismatched inputs, then notes that pricing varies by country.
Type-Safe Authentication in Rust with Auth0 and Axum
CLI applications cannot use a standard browser redirect OAuth login flow when no browser or redirect URL is available, so the tutorial uses OAuth 2.0 Device Authorization Flow. It builds an end-to-end Rust workspace containing a CLI, a shared auth-lib crate, and an Axum API configured with Auth0. The CLI requests a device code, displays a verification URL and user code, polls for an ID token and access token, then sends the access token as a Bearer credential. The API middleware fetches JWKS, selects the key matching the JWT’s kid, validates RS256 signatures plus issuer and audience claims, and deserializes strongly typed UserClaims. With valid claims, a protected route returns a message and subject; otherwise the extractor returns an unauthorized response.
Beyond answers: New Genie One features to turn insights into action
Genie One’s latest updates target the manual work that follows an AI-generated answer, including accuracy checks, report formatting, sharing, and repeated workflows. The release adds a native macOS desktop app in beta with a global launcher, persistent conversations across web and desktop, and access to documents, skills, scheduled tasks, Genie Agents, and Databricks Apps. Genie One can create editable documents with live visualizations, comments, version history, sharing, PDF export, and external-document editing through MCP writes. Users can also turn conversations into reusable, shareable Genie Agents or distribute read-only chat links containing questions, answers, visualizations, and context. Additional capabilities include ontology snippets, private uploads of supported files, and governed MCP actions, with Unity Catalog, source authentication, and Unity Gateway governing access across assets and connected tools.
Security Incident Affecting JetBrains Cadence
JetBrains reports a security incident affecting Cadence, its hosted service that integrates with PyCharm through an optional plugin and runs projects on cloud compute resources. Cadence used TeamCity to orchestrate workloads, and attackers exploited the environment through critical vulnerability CVE-2026-63077. The attackers accessed personal data, compromised a 2024 server backup and Cadence-related AWS IAM credentials, and accessed files in JetBrains AWS S3 buckets; the scope remains under investigation. JetBrains discovered the exploitation on August 23, took the server offline on August 24, invalidated plugin access tokens, and urges users to rotate secrets, investigate connected systems, review repositories, and treat executions and synchronized files as untrusted.
How to Approve Real Users and Block Fake Accounts at Sign Up with Lookup and Verify in C#
Fake accounts and fraudulent sign-ups motivate a C# onboarding flow that screens phone numbers before sending an OTP. It combines Twilio Lookup line type intelligence, optional line status checks, and Identity Match with Twilio Verify phone verification. The pipeline rejects landline, nonfixed VoIP, toll-free, and pager types, requires first- and last-name results of exact_match or high_partial_match, and can reject lookup failures or mismatches. The post supplies a .NET 9 project setup, environment variables, MVC files, and service code for starting and checking verification. It reports example logs for a mobile number with active status and exact name matches, demonstrates blocked toll-free or VoIP testing, and notes that Lookup and Verify pricing varies by package and country.
Migrating to Auth0 for Startups from Another Auth Solution
Evenpay develops compensation transparency software to meet the EU Pay Transparency Directive, requiring strict safeguards for sensitive employee salary data. The startup initially selected a lightweight B2B authentication platform for quick onboarding, but soon encountered unmet data residency and compliance demands from Finnish enterprise clients. To resolve these limitations, Evenpay migrated all customers to Auth0 over a few weeks using documentation and AI assistance. Adopting Auth0 allowed the team to fulfill regional EU data controls while reducing managed Single Sign-On setup times from weeks to as little as one day through self-service options. Furthermore, relying on an established authentication brand provided instant credibility with enterprise security officers without requiring custom authentication development.
Supercharge Auth with Signals and the New Okta Angular SDK
The updated Okta Angular SDK introduces fully standalone architecture, eliminating NgModules and wrapper functions in favor of standalone providers and functional guards. In an Angular v22 sample project, authentication is configured with the provideOktaAuth function without requiring a custom backend. Route security utilizes functional guards, while user and group data fetch flows are handled using rxResource alongside signal inputs. To support dynamic environments without requiring rebuilds or redeployments, the setup implements runtime configuration loading via provideAppInitializer and OktaAuthConfigService. Security is further bolstered by binding access tokens to browser key pairs using Demonstrating Proof of Possession alongside OAuth 2.1 and OpenID Connect protocols.
Whatever You Are Building, Auth0 Has a Plan
Authentication and identity requirements vary substantially as software organizations scale from solo builders to multi-brand enterprises. Building and maintaining authentication in-house frequently consumes valuable engineering cycles and incurs ongoing costs associated with security patching and edge cases. To address these distinct development stages, Auth0 structures its platform across Free, Essentials, Professional, and Enterprise tiers with differentiated B2C and B2B pricing. Early-stage and growing teams gain access to enterprise connections, SCIM user synchronization, and multi-tenant routing through Auth0 Organizations. Larger customer deployments utilize features like multi-app Single Sign-On and passwordless logins, which have driven reported outcomes such as a 20% conversion lift and a 66% reduction in identity management time.
Auth0, Made for Whatever You Are Building
Rapid application development with AI coding tools often produces unreviewed custom authentication logic that handles sensitive Personally Identifiable Information and regulatory requirements like HIPAA. Autonomous AI agents compound these security challenges by significantly widening an application's overall attack surface. Standardizing on Auth0 provides an established identity layer that integrates into agentic workflows via Claude plugins, an Auth0 MCP server, and standardized agent skill packages. This setup exposes Auth0 Management APIs and official documentation directly to AI agents, achieving integration times of three to four minutes according to Agent Experience metrics. Incorporating these pre-built patterns maintains security baselines while supporting scaling requirements across B2B plans for initial user bases up to 1,000 monthly active users.
Enterprise-managed auth for the Supabase MCP server
Supabase has generally released enterprise-managed authentication for its MCP server on Supabase Team and Enterprise plans, built with Anthropic and Okta. The change moves authorization for using Supabase in Claude to the organization's identity provider: an administrator authorizes the connector once, while employees receive access according to their existing Supabase projects and permissions. Each query and management action runs with the individual employee's current role, so developers and read-only members do not receive more access than they have in Supabase directly. Okta groups can restrict access, and onboarding, offboarding, and access reviews can be handled through existing identity-provider workflows rather than individual OAuth approvals; availability requires Okta SSO plus a Claude Team or Enterprise plan, with SCIM provisioning listed as a future roadmap item.
Add Cross App Access to Your OIDC Resource Application
Cross App Access allows applications such as AI agents to access resource APIs on behalf of OpenID Connect federated users. The specification relies on an Identity Assertion Authorization Grant, which is a short-lived JSON Web Token issued by the customer Identity Provider. Resource authorization servers validate this token, resolve user identities using combined issuer and subject claims, and issue locally scoped access tokens without altering single sign-on flows. Implementations must bind issuers to registered connections before verifying signatures to prevent forgery attacks. In addition, servers should not issue refresh tokens, as clients instead resubmit the grant upon access token expiration.
Branded Login URLs and Email Workflows for Production Auth
Default authentication setups often redirect users to third-party domains and issue generic transactional emails, causing password manager failures, browser cookie restrictions, and perceived phishing risks. To mitigate these issues, teams can configure custom identity domains via DNS CNAME records to preserve origin alignment and session persistence. Developers can also capture custom user fields directly within hosted login prompts using Universal Login partials alongside pre-registration Actions rather than managing custom authentication servers. For transactional messaging, teams must replace rate-limited built-in email tools with dedicated external providers and configure SPF, DKIM, and DMARC records alongside Liquid-templated emails. Managing these configurations through version control and deployment tools maintains security standards without adding excessive infrastructure maintenance overhead.
Adding a UI to an Auth0-secured MCP server with Skybridge
Skybridge can return a React view alongside structured data from an MCP tool, allowing hosts such as ChatGPT, Claude, and VS Code to render an interface in the conversation. The tutorial scaffolds an MCP app, adds Auth0 through Skybridge’s auth0Provider, and protects the /mcp transport with bearer JWT verification before requests reach tool handlers. Auth0’s default opaque tokens create a compatibility issue because MCP clients send RFC 8707 resource indicators rather than an audience, so Skybridge advertises an authorization endpoint that includes the API audience. The view receives the verified user identity through structuredContent instead of relying on a name supplied by the model. Its additional tool calls use the same authenticated MCP session, and testing proceeds through DevTools, the Playground, real hosts, and deployment.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.