Authorization Is a Runtime Decision
See how an agent request becomes an allowed or denied tool action through identity context, policy checks, scoped credentials, and an auditable decision trail.
Loading…
Topic
Authentication
229 posts about Authentication. Every summary links to the original.
- 229 posts
- 29 companies
- 5 explainers
See the idea
Authentication explainers
Axum at the Trust Boundary: From Request to Protected Response
Axum is a Rust web framework for composing routes, middleware, and extractors. This explainer shows how different login flows become verified identity before a handler responds.
The Token’s Route: From Auth0 Login to API Authorization
See how an Auth0 login becomes an API decision: redirect the user, issue the right token, validate its claims, and apply audience, scope, and access policies.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Introducing ClickStack Cloud: Serverless observability powered by ClickHouse
ClickStack Cloud is entering private preview as a fully managed, serverless observability service built on ClickHouse for teams that want ClickHouse-powered logs, metrics, and traces without operating the underlying infrastructure. Users send OpenTelemetry data to a managed OTLP endpoint, while the service handles ingestion, durable buffering through an object-storage-backed event queue, scaling, storage, and query serving, then exposes telemetry in the ClickStack UI with integrated authentication and RBAC. The preview separates ingestion and query resources and is developing automatic tuning based on query patterns, including materialized fields, primary-key adjustments, materialized views, and indexes. Dedicated query compute for agentic and high-volume analytical workloads is planned after the preview, while pricing remains unfinished and the existing Managed ClickStack offering remains intended for teams requiring direct infrastructure and schema control.
Use Passkeys Wherever You Sign in to Uber
Uber rolled out passkey authentication across mobile apps and websites, allowing users to sign in without passwords. Passkeys use a device-generated public-private key pair: the server stores the public key, while the device’s password manager protects the private key and requires biometric, PIN, or pattern authorization. Registration sends creation options and a challenge to the authenticator, which returns an attestation for server validation; sign-in similarly returns a signed assertion that the server verifies with the stored public key. This design keeps private keys and user authorization data on the authenticator, improving resistance to phishing, credential stuffing, brute force, and replay attacks. Uber reported low initial adoption and noted inconsistent browser and device support, user education needs, and technical complexity; it plans to use adoption data and post-authentication prompts to improve onboarding.
Protecting your Supabase projects from npm supply chain attacks
The post explains why npm supply-chain attacks matter to Supabase projects: Edge Functions, the Supabase CLI, and packages including supabase-js, @supabase/ssr, and @supabase/server all depend on npm. Attackers can compromise maintainers, register typosquats, or exploit build pipelines; once malicious code reaches node_modules, lifecycle scripts may read environment variables, cloud metadata, tokens, kubeconfig, and SSH keys. The proposed defense is layered: upgrade to pnpm 11, increase minimumReleaseAge to several days, pin sensitive dependency versions, commit and review lockfiles, disable or allowlist install scripts, verify package names, and pin GitHub Actions to full commit SHAs. Supabase is publishing a canonical security guide, hardening its GitHub Actions, adding secret-handling warnings to API documentation, and coordinating communications; the post also recommends rotating credentials after a potentially compromised install and using scanners as supplementary defense.
What it feels like building with Stripe Projects
The post recounts a 60-minute attempt to build a GitHub traffic dashboard with Stripe Projects, motivated by GitHub’s 14-day limit on traffic history. Using Cursor’s agentic chat workflow alongside Projects, the builder assembled a Next.js application with Auth0 authentication, Supabase persistence, Prisma schema management, Vercel hosting, scheduled jobs, environment wiring, and periodic GitHub traffic synchronization. The experiment largely avoided direct coding and instead tested whether AI-mediated orchestration could produce a production-shaped stack quickly. As services and credentials appeared across providers, the main difficulty shifted from implementation to understanding ownership, deployment topology, environment management, and operational flow. The repositories synced, charts populated, and historical data appeared, while the experience also exposed a need for clearer generated architecture or infrastructure-as-code descriptions of the assembled system.
Solving the Identity Crisis for AI Agents
Uber describes its 2025 effort to give AI agents verifiable identities and preserve attribution as agents act for users across compositional, multi-step workflows. The problem is that conventional human and workload identities expose only generic service identities, dropping originating users and intermediate agents across hops and weakening audits, authorization, and incident response. The design extends Uber’s Zero Trust Architecture with an Agent Registry, an AI Agent Mesh, Security Token Service (STS), MCP Gateway, downstream systems, and an AI Gateway, while integrating identity and context propagation into the agent SDK. Workloads obtain cryptographically signed workload SVIDs from SPIRE, and STS issues short-lived, scoped JWTs for each hop; MCP Gateway authenticates and authorizes tool calls. Production metrics reported show P99 STS token-exchange latency consistently below 40 milliseconds, while the roadmap places dynamic access control and unified policy enforcement above the identity foundation.
clickhousectl v0.2.0: Postgres, ClickPipes and more
clickhousectl v0.2.0 expands the beta CLI with local and ClickHouse Cloud managed Postgres, ClickPipes, SQL over HTTP for Cloud services, agent-oriented output changes, and a standalone Rust client for the ClickHouse Cloud API. Local Postgres runs in Docker, is keyed by name and major version, stores isolated data under .clickhouse/servers/-pg/data/, and supports versions 16, 17, and 18. ClickPipes covers batch, streaming, CDC, and snapshot sources including object storage, Kafka-compatible systems, Kinesis, Postgres, MySQL, MongoDB, and BigQuery. Cloud queries use a provisioned or lazily enabled Query Endpoint and service-scoped API key, while the endpoint uses sql_console_admin and the key has no organization-level roles. The release also adds Markdown-style tables and credential debugging, with more than 5,000 users reported five weeks into the project.
Six Steps to Improve Your Sender Reputation
Sender reputation is the largely private assessment that inbox service providers such as Gmail, Outlook, and Yahoo make before deciding where to deliver email. It reflects infrastructure compliance, sending history and consistency, list hygiene, mail frequency, and recipient engagement, with providers increasingly emphasizing domain reputation over IP reputation. The guide recommends six recovery steps: audit SPF, DKIM, and DMARC; warm up new domains gradually; identify provider-specific blocks or blocklists; clean and segment lists; make unsubscribing easy; and send valuable, mobile-friendly content. It also advises using double opt-in, monitoring engagement, bounce and spam responses, throttling, and DMARC reports, while tightening policies or requesting provider reviews after fixes. Because providers continually reevaluate senders, reputation management requires repeated observation, testing, and adjustment rather than a one-time repair.
Introducing @supabase/server
Supabase is releasing @supabase/server in public beta, a package for authentication verification, client setup, request context, and common server-side boilerplate across backend runtimes. Supabase says an anonymous analysis of 25,000 deployed Edge Functions found developers repeatedly rebuilding setup for clients, JWT verification, claims parsing, CORS, auth context, and shared files. The package's withSupabase wrapper or createSupabaseContext function supplies a SupabaseContext containing a user-scoped client, service-role admin client, verified identity, JWT claims, auth metadata, and auth mode, while declarative modes cover user, none, secret, publishable, or combined access. It returns standard Request-to-Response handlers for Edge Functions, Vercel Functions, Cloudflare Workers, Hono, Bun, and Deno, and includes primitives for custom middleware and adapters. @supabase/server does not replace @supabase/ssr, which remains focused on cookie-based sessions, and the release invites feedback on its public-beta API and adapters.
Agentic identity: modeling agents to keep users in control
Ramp for Agents adds CLI and MCP interfaces through which AI agents can manage cards, bills, expenses, and approvals, creating a need to represent agents as accountable actors instead of handing them users’ session tokens or API keys. The initial identity model links a named Agent Key to a human sponsor and business, bounds scopes by the sponsor’s role, records agent attribution, and adds expiration and revocation. Ramp extends RBAC and its DenormalizedActor audit model with AgentContext, so logs, approvals, and webhooks can distinguish “Sarah (via Codex)” while reusing existing permissioning and rendering paths. OAuth2-PKCE exchanges the Agent Key for short-lived access and refresh tokens, with re-validation during refresh to limit leaked-credential exposure and preserve session traceability. The first release uses on-behalf-of-user agents because they fit current demand and keep a human accountable, while admins can oversee keys or disable agent access for roles and groups.
ClickHouse integrates with Lakehouse Runtime Catalog
ClickHouse 26.2 introduced a beta integration with Google's Lakehouse Runtime Catalog, enabling direct queries on Google Cloud Lakehouse Apache Iceberg tables without data movement or metadata syncing. The system communicates with Google Cloud Storage through the Iceberg REST Catalog endpoint at BigLake using Google Application Default Credentials for OAuth authentication. Users create a database using the DataLakeCatalog engine configured either with a local credentials JSON file or with explicit inline OAuth parameters. Once connected, analysts can query external Iceberg tables directly or ingest datasets into native MergeTree tables for repeated, low-latency workloads. Upcoming enhancements will add write capabilities for Iceberg tables and dedicated connection management tools inside the ClickHouse Cloud interface.
Using the ClickHouse MCP server with Google Antigravity
Google Antigravity integrates with the ClickHouse Model Context Protocol server to provide agent-driven analytics within the developer environment. Users install the server from Antigravity's MCP Store panel and authenticate via OAuth, granting the agent read-only access to organizations, services, databases, and tables according to account permissions. When prompted with natural language, the agent uses tools like get_services_list and list_tables to inspect schemas, translating user requests into functional ClickHouse SQL executed through the run_select_query tool. Antigravity can also generate interactive React charts as Artifacts, test UI interactions with screen recordings and screenshots in an integrated browser, and refine queries based on visual area comments. This setup allows engineers and analysts to explore datasets interactively without switching between external database clients and ticketing workflows.
Unity AI Gateway: How to connect agents to external MCPs securely
Databricks Unity AI Gateway provides a governed way to connect agents to external Model Context Protocol (MCP) servers while integrating management with Unity Catalog. The post addresses provider-specific OAuth app registration, client secrets, token refresh, permission auditing, and the lack of centralized visibility into agent access. It describes registering an external MCP server, choosing per-user OAuth or a shared principal, selecting GitHub, and letting Databricks handle OAuth registration, token exchange, and refresh; connections can then be tested in AI Playground or with DatabricksMCPClient and deployed through Agent Bricks. Unity Catalog supplies permissions and audit records, while MLflow Tracing captures requests and tool interactions, and supported providers include Glean, GitHub, Atlassian, Google Drive, and SharePoint across AWS, Azure, and GCP.
Custom OIDC Providers for Supabase Auth
Supabase has launched Custom OIDC Providers, enabling projects to connect standards-compliant external OpenID Connect identity providers beyond its built-in social options. Configuration requires an issuer URL, client credentials, and scopes; Supabase automatically resolves the discovery document, endpoints, and JWKS, and verifies ID tokens against the provider’s JWKS. After enablement, users use the standard OAuth sign-in flow through existing JavaScript, Flutter, or Swift clients, while the auth server handles redirects, code exchange, profile retrieval, and user creation or linking. Custom providers include default PKCE, authorization-parameter support, multi-platform audience validation through acceptable_client_ids, and an email_optional setting for providers that do not return email addresses. They can be created, listed, updated, or deleted via the Dashboard or Admin API, with a limit of three per project.
Announcing Role Based Access Control in ClickStack
Managed ClickStack has introduced Role-Based Access Control (RBAC) to replace a legacy model where all users shared identical instance-wide permissions or required duplicate HyperDX instances for isolation. Integrated with ClickHouse Cloud for identity management, the new system allows administrators to assign users to roles governed by three access tiers: no access, read, and manage. Permissions apply across platform resources including dashboards, saved searches, sources, alerts, webhooks, and notebooks, with support for fine-grained rules matching names, IDs, or tags. While table-level source restrictions work through ClickStack, row-level access currently depends on separate ClickHouse SQL console roles, which the team intends to unify directly inside ClickStack in future releases.
Provision a production-ready dev stack from your terminal
Stripe Projects, a new tool in the Stripe CLI, addresses the manual, fragmented work of turning a local prototype into a production-ready environment. It manages a project manifest and Stripe-backed record for attached services, provider accounts, and required credentials, while an integration protocol standardizes provisioning, plan selection, upgrades, and credential handoff. The developer preview supports services from providers including Vercel, Railway, Supabase, Neon, PlanetScale, Turso, Chroma, PostHog, Clerk, and Runloop; resources remain in accounts owned by the developer, and credentials can be synced to local development, CI, or a team secret manager. Through CLI commands such as stripe projects init, add, upgrade, and env --pull, developers or coding agents can repeat setup, audit changes, and upgrade supported plans using tokenized payment credentials, although payment handoff is limited to supported providers and plans in the US, EU, UK, and Canada.
Supabase Joins the Stripe Projects Developer Preview
Supabase has joined the Stripe Projects developer preview, a Stripe CLI workflow for provisioning real services and obtaining working credentials with a single command. The integration provisions a complete Supabase project—including Postgres, Auth, Storage, Edge Functions, and Realtime—without requiring dashboard interaction, while supporting both developers and AI agents through deterministic, repeatable steps. After installing the Stripe CLI and adding supabase/project, stripe projects env --sync writes credentials to a local .env file and stores them in the Stripe Project for agent access; existing Supabase users can link their account. Projects remain in the user’s Supabase account with dashboard, connection-string, and data access, and database credentials can be rotated with stripe projects rotate supabase/project. The feature is a developer preview, and Stripe and Supabase are requesting feedback through Discord or GitHub.
ClickHouse Release 26.2
ClickHouse version 26.2 introduces twenty-five new features, forty-three performance optimizations, and one hundred eighty-three bug fixes across the database engine. This release graduates both the text-index and the QBit vector embedding data type to production-ready status for search and retrieval workloads. For streaming ingestion pipelines where row arrival rates are low, the engine adds time-based block flushing configurations to write data parts before hitting default row or byte thresholds. The update also embeds the ClickStack observability user interface directly into the standard binary distribution, accessible through the local HTTP server port. Further enhancements include automatic min-max indexing for temporal columns in MergeTree tables, interactive time-based one-time password authentication in the client, and a high-performance prime number generator function.
Building a mental model for Stripe payments
An online bookshop checkout must coordinate card networks, issuing banks, fraud checks, regulatory requirements, currencies, and varied payment methods while completing in roughly 2–3 seconds. Stripe abstracts these concerns through a unified API, with the PaymentIntent representing the payment lifecycle from amount and currency collection through tokenization, authorization, capture, and settlement. The Payment Element and client-side tokenization keep sensitive card details away from the shop’s servers, while Stripe may perform risk checks and additional 3D Secure authentication. Because payments can change state minutes, hours, or days later through refunds and disputes, webhook events should be treated as the source of truth for synchronizing order and downstream systems without polling.
Introducing swift-huggingface: The Complete Swift Client for Hugging Face
Hugging Face released swift-huggingface, a dedicated Swift package offering complete Hub API integration, reliable file downloads, and inference provider access. The library addresses previous limitations in swift-transformers 1.0, where interrupted multi-gigabyte model downloads could not resume and cache structures differed from Python. To resolve cache duplication, swift-huggingface implements a Python-compatible content-addressed storage layout using symlinks and flock file locking. Authentication is standardized through a TokenProvider pattern supporting auto-detection, Keychain integration, static CI/CD tokens, and OAuth 2.0 sign-in with automatic token refresh. The package also provides URLSession-backed snapshot downloads with granular progress tracking and will soon replace the HubApi implementation inside swift-transformers.
Unwrap Innovation: How Sellers and Buyers Use AI to Brighten the Holidays
eBay describes how its AI tools aim to reduce holiday-season friction for sellers and improve discovery and trust for buyers. More than 10M unique sellers have used its AI features, while sellers create more than half a million new listings daily using Generative AI. The simplified listing experience can start with an image, background enhancement adds festive professional-grade backgrounds, and AI Assistant for messaging drafts replies to common questions about item specifics or shipping. For shoppers, an AI shopping assistant pilot, LLM-powered fashion recommendations, and access to eBay’s inventory through third-party agents including OpenAI partnerships support personalized discovery. Trust features include Authenticity Guarantee expert verification for handbags, jewelry, and trading cards, plus Certilogo’s digital IDs and authentication for apparel, while eBay says these measures support safer participation in the circular economy.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.