---
title: "Authentication"
description: "232 posts about Authentication, summarised, each linking to the original."
---

# Authentication
> 232 posts about Authentication, summarised, each linking to the original.

## Articles

### [From hobby to real world: integrating the hard stuff with agents](https://yomu.fyi/post/from-hobby-to-real-world-integrating-the-hard-stuff-with-agents.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: Anna Spysz
- Published: Jun 16, 2026
- Type: Tutorial

The post documents building a production-oriented leaderboard for open-source Stripe Projects applications, where users submit projects, share links, and vote. Unlike an earlier transcription app, this project required authentication, multiple database tables, hosting, and controls limiting unauthenticated users to one vote per project. The agent initially selected Supabase for database and auth and Vercel for hosting, then added Upstash Redis after an in-memory rate limiter proved unsuitable for serverless enforcement. Supabase's two-emails-per-hour authentication limit prompted a human-directed migration to Clerk, after the agent proposed an unsuitable Twilio solution. The resulting MVP used five resources across four providers, took more than a day, and received separate security and performance audits before review.


### [Announcing the Public Preview of Custom URLs](https://yomu.fyi/post/announcing-the-public-preview-of-custom-urls.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Gordon Wang, Steve Costa, Ankit Mishra
- Published: Jun 10, 2026
- Type: Announcement

Databricks has announced the public preview of Custom URLs, giving each account a single branded domain that serves its workspaces. Previously, workspace-specific URLs made navigation, sharing, bookmarking, and account-wide features more cumbersome, while users had to log in repeatedly when switching workspaces. Custom URLs use a shared account session to verify access and create workspace sessions seamlessly, while preserving authorization boundaries and keeping existing per-workspace URLs functional. The feature provides a unified Genie entry point, cross-workspace Unity Catalog lineage, and an account-level URL that remains stable during disaster-recovery failover, including for downstream tools using existing connection strings. Activation requires Unified Login; Frontend Private Link workspaces fall back to per-workspace URLs, and account admins can claim a URL, enable it, and optionally turn on automatic redirects.


### [What's new in clickhousectl v0.3.0](https://yomu.fyi/post/what-s-new-in-clickhousectl-v0-3-0.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Jun 9, 2026
- Type: Announcement

clickhousectl v0.3.0 adds improvements aimed at agentic workflows, additional installation methods, OAuth for Cloud service queries, and custom configuration files for local servers. It detects coding-agent environments and defaults to JSON on stdout, uses gh-style exit codes, reads CLICKHOUSE\_ credentials from a working-directory .env file, and hides deprecated API fields from CLI output. Cloud service queries can authenticate with OAuth without provisioning a Query Endpoint; idled services wake automatically, while stopped services fail with a start hint. For local development, selected versions resolve from installed binaries before network lookup, local use can put ClickHouse on PATH, and named XML, YAML, or YML files overlay built-in defaults. The release also adds Python installation options and extends local init with a postgres/ tree alongside clickhouse/.


### [Introducing ClickStack Cloud: Serverless observability powered by ClickHouse](https://yomu.fyi/post/introducing-clickstack-cloud-serverless-observability-powered-by-click.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: May 27, 2026
- Type: Announcement

ClickStack Cloud is entering private preview as a fully managed, serverless observability service built on ClickHouse for teams that want ClickHouse-powered logs, metrics, and traces without operating the underlying infrastructure. Users send OpenTelemetry data to a managed OTLP endpoint, while the service handles ingestion, durable buffering through an object-storage-backed event queue, scaling, storage, and query serving, then exposes telemetry in the ClickStack UI with integrated authentication and RBAC. The preview separates ingestion and query resources and is developing automatic tuning based on query patterns, including materialized fields, primary-key adjustments, materialized views, and indexes. Dedicated query compute for agentic and high-volume analytical workloads is planned after the preview, while pricing remains unfinished and the existing Managed ClickStack offering remains intended for teams requiring direct infrastructure and schema control.


### [Use Passkeys Wherever You Sign in to Uber](https://yomu.fyi/post/use-passkeys-wherever-you-sign-in-to-uber.md)
- Company: [Uber](https://yomu.fyi/company/uber.md)
- Published: May 26, 2026
- Type: Explainer

Uber rolled out passkey authentication across mobile apps and websites, allowing users to sign in without passwords. Passkeys use a device-generated public-private key pair: the server stores the public key, while the device’s password manager protects the private key and requires biometric, PIN, or pattern authorization. Registration sends creation options and a challenge to the authenticator, which returns an attestation for server validation; sign-in similarly returns a signed assertion that the server verifies with the stored public key. This design keeps private keys and user authorization data on the authenticator, improving resistance to phishing, credential stuffing, brute force, and replay attacks. Uber reported low initial adoption and noted inconsistent browser and device support, user education needs, and technical complexity; it plans to use adoption data and post-authentication prompts to improve onboarding.


### [Protecting your Supabase projects from npm supply chain attacks](https://yomu.fyi/post/protecting-your-supabase-projects-from-npm-supply-chain-attacks.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: katerina\_skroumpelou
- Published: May 26, 2026
- Type: Explainer

The post explains why npm supply-chain attacks matter to Supabase projects: Edge Functions, the Supabase CLI, and packages including supabase-js, @supabase/ssr, and @supabase/server all depend on npm. Attackers can compromise maintainers, register typosquats, or exploit build pipelines; once malicious code reaches node\_modules, lifecycle scripts may read environment variables, cloud metadata, tokens, kubeconfig, and SSH keys. The proposed defense is layered: upgrade to pnpm 11, increase minimumReleaseAge to several days, pin sensitive dependency versions, commit and review lockfiles, disable or allowlist install scripts, verify package names, and pin GitHub Actions to full commit SHAs. Supabase is publishing a canonical security guide, hardening its GitHub Actions, adding secret-handling warnings to API documentation, and coordinating communications; the post also recommends rotating credentials after a potentially compromised install and using scanners as supplementary defense.


### [What it feels like building with Stripe Projects](https://yomu.fyi/post/what-it-feels-like-building-with-stripe-projects.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: Ben Smith
- Published: May 26, 2026
- Type: Explainer

The post recounts a 60-minute attempt to build a GitHub traffic dashboard with Stripe Projects, motivated by GitHub’s 14-day limit on traffic history. Using Cursor’s agentic chat workflow alongside Projects, the builder assembled a Next.js application with Auth0 authentication, Supabase persistence, Prisma schema management, Vercel hosting, scheduled jobs, environment wiring, and periodic GitHub traffic synchronization. The experiment largely avoided direct coding and instead tested whether AI-mediated orchestration could produce a production-shaped stack quickly. As services and credentials appeared across providers, the main difficulty shifted from implementation to understanding ownership, deployment topology, environment management, and operational flow. The repositories synced, charts populated, and historical data appeared, while the experience also exposed a need for clearer generated architecture or infrastructure-as-code descriptions of the assembled system.


### [Solving the Identity Crisis for AI Agents](https://yomu.fyi/post/solving-the-identity-crisis-for-ai-agents.md)
- Company: [Uber](https://yomu.fyi/company/uber.md)
- Published: May 21, 2026
- Type: Explainer

Uber describes its 2025 effort to give AI agents verifiable identities and preserve attribution as agents act for users across compositional, multi-step workflows. The problem is that conventional human and workload identities expose only generic service identities, dropping originating users and intermediate agents across hops and weakening audits, authorization, and incident response. The design extends Uber’s Zero Trust Architecture with an Agent Registry, an AI Agent Mesh, Security Token Service (STS), MCP Gateway, downstream systems, and an AI Gateway, while integrating identity and context propagation into the agent SDK. Workloads obtain cryptographically signed workload SVIDs from SPIRE, and STS issues short-lived, scoped JWTs for each hop; MCP Gateway authenticates and authorizes tool calls. Production metrics reported show P99 STS token-exchange latency consistently below 40 milliseconds, while the roadmap places dynamic access control and unified policy enforcement above the identity foundation.


### [clickhousectl v0.2.0: Postgres, ClickPipes and more](https://yomu.fyi/post/clickhousectl-v0-2-0-postgres-clickpipes-and-more.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Author: Al Brown
- Published: May 20, 2026
- Type: Announcement

clickhousectl v0.2.0 expands the beta CLI with local and ClickHouse Cloud managed Postgres, ClickPipes, SQL over HTTP for Cloud services, agent-oriented output changes, and a standalone Rust client for the ClickHouse Cloud API. Local Postgres runs in Docker, is keyed by name and major version, stores isolated data under .clickhouse/servers/-pg/data/, and supports versions 16, 17, and 18. ClickPipes covers batch, streaming, CDC, and snapshot sources including object storage, Kafka-compatible systems, Kinesis, Postgres, MySQL, MongoDB, and BigQuery. Cloud queries use a provisioned or lazily enabled Query Endpoint and service-scoped API key, while the endpoint uses sql\_console\_admin and the key has no organization-level roles. The release also adds Markdown-style tables and credential debugging, with more than 5,000 users reported five weeks into the project.


### [Six Steps to Improve Your Sender Reputation](https://yomu.fyi/post/six-steps-to-improve-your-sender-reputation.md)
- Company: [Resend](https://yomu.fyi/company/resend.md)
- Published: May 20, 2026
- Type: Tutorial

Sender reputation is the largely private assessment that inbox service providers such as Gmail, Outlook, and Yahoo make before deciding where to deliver email. It reflects infrastructure compliance, sending history and consistency, list hygiene, mail frequency, and recipient engagement, with providers increasingly emphasizing domain reputation over IP reputation. The guide recommends six recovery steps: audit SPF, DKIM, and DMARC; warm up new domains gradually; identify provider-specific blocks or blocklists; clean and segment lists; make unsubscribing easy; and send valuable, mobile-friendly content. It also advises using double opt-in, monitoring engagement, bounce and spam responses, throttling, and DMARC reports, while tightening policies or requesting provider reviews after fixes. Because providers continually reevaluate senders, reputation management requires repeated observation, testing, and adjustment rather than a one-time repair.


### [Introducing @supabase/server](https://yomu.fyi/post/introducing-supabase-server.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: tomas\_pozo, kalleby\_santos, katerina\_skroumpelou, matt\_johnston
- Published: May 6, 2026
- Type: Announcement

Supabase is releasing @supabase/server in public beta, a package for authentication verification, client setup, request context, and common server-side boilerplate across backend runtimes. Supabase says an anonymous analysis of 25,000 deployed Edge Functions found developers repeatedly rebuilding setup for clients, JWT verification, claims parsing, CORS, auth context, and shared files. The package's withSupabase wrapper or createSupabaseContext function supplies a SupabaseContext containing a user-scoped client, service-role admin client, verified identity, JWT claims, auth metadata, and auth mode, while declarative modes cover user, none, secret, publishable, or combined access. It returns standard Request-to-Response handlers for Edge Functions, Vercel Functions, Cloudflare Workers, Hono, Bun, and Deno, and includes primitives for custom middleware and adapters. @supabase/server does not replace @supabase/ssr, which remains focused on cookie-based sessions, and the release invites feedback on its public-beta API and adapters.


### [Agentic identity: modeling agents to keep users in control](https://yomu.fyi/post/agentic-identity-modeling-agents-to-keep-users-in-control.md)
- Company: [Ramp](https://yomu.fyi/company/ramp.md)
- Author: Steve Venzerul, Rachel Kaplan
- Published: May 4, 2026
- Type: Problem & solution

Ramp for Agents adds CLI and MCP interfaces through which AI agents can manage cards, bills, expenses, and approvals, creating a need to represent agents as accountable actors instead of handing them users’ session tokens or API keys. The initial identity model links a named Agent Key to a human sponsor and business, bounds scopes by the sponsor’s role, records agent attribution, and adds expiration and revocation. Ramp extends RBAC and its DenormalizedActor audit model with AgentContext, so logs, approvals, and webhooks can distinguish “Sarah (via Codex)” while reusing existing permissioning and rendering paths. OAuth2-PKCE exchanges the Agent Key for short-lived access and refresh tokens, with re-validation during refresh to limit leaked-credential exposure and preserve session traceability. The first release uses on-behalf-of-user agents because they fit current demand and keep a human accountable, while admins can oversee keys or disable agent access for roles and groups.


### [ClickHouse integrates with Lakehouse Runtime Catalog](https://yomu.fyi/post/clickhouse-integrates-with-lakehouse-runtime-catalog.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Author: Melvyn Peignon
- Published: Apr 22, 2026
- Type: Announcement

ClickHouse 26.2 introduced a beta integration with Google's Lakehouse Runtime Catalog, enabling direct queries on Google Cloud Lakehouse Apache Iceberg tables without data movement or metadata syncing. The system communicates with Google Cloud Storage through the Iceberg REST Catalog endpoint at BigLake using Google Application Default Credentials for OAuth authentication. Users create a database using the DataLakeCatalog engine configured either with a local credentials JSON file or with explicit inline OAuth parameters. Once connected, analysts can query external Iceberg tables directly or ingest datasets into native MergeTree tables for repeated, low-latency workloads. Upcoming enhancements will add write capabilities for Iceberg tables and dedicated connection management tools inside the ClickHouse Cloud interface.


### [Using the ClickHouse MCP server with Google Antigravity](https://yomu.fyi/post/using-the-clickhouse-mcp-server-with-google-antigravity.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Author: Dustin Healy
- Published: Apr 22, 2026
- Type: Tutorial

Google Antigravity integrates with the ClickHouse Model Context Protocol server to provide agent-driven analytics within the developer environment. Users install the server from Antigravity's MCP Store panel and authenticate via OAuth, granting the agent read-only access to organizations, services, databases, and tables according to account permissions. When prompted with natural language, the agent uses tools like get\_services\_list and list\_tables to inspect schemas, translating user requests into functional ClickHouse SQL executed through the run\_select\_query tool. Antigravity can also generate interactive React charts as Artifacts, test UI interactions with screen recordings and screenshots in an integrated browser, and refine queries based on visual area comments. This setup allows engineers and analysts to explore datasets interactively without switching between external database clients and ticketing workflows.


### [Unity AI Gateway: How to connect agents to external MCPs securely](https://yomu.fyi/post/unity-ai-gateway-how-to-connect-agents-to-external-mcps-securely.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Ahmed Bilal, Sunish Sheth
- Published: Apr 15, 2026
- Type: Tutorial

Databricks Unity AI Gateway provides a governed way to connect agents to external Model Context Protocol (MCP) servers while integrating management with Unity Catalog. The post addresses provider-specific OAuth app registration, client secrets, token refresh, permission auditing, and the lack of centralized visibility into agent access. It describes registering an external MCP server, choosing per-user OAuth or a shared principal, selecting GitHub, and letting Databricks handle OAuth registration, token exchange, and refresh; connections can then be tested in AI Playground or with DatabricksMCPClient and deployed through Agent Bricks. Unity Catalog supplies permissions and audit records, while MLflow Tracing captures requests and tool interactions, and supported providers include Glean, GitHub, Atlassian, Google Drive, and SharePoint across AWS, Azure, and GCP.


### [Custom OIDC Providers for Supabase Auth](https://yomu.fyi/post/custom-oidc-providers-for-supabase-auth.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: cemal\_kilic
- Published: Apr 8, 2026
- Type: Announcement

Supabase has launched Custom OIDC Providers, enabling projects to connect standards-compliant external OpenID Connect identity providers beyond its built-in social options. Configuration requires an issuer URL, client credentials, and scopes; Supabase automatically resolves the discovery document, endpoints, and JWKS, and verifies ID tokens against the provider’s JWKS. After enablement, users use the standard OAuth sign-in flow through existing JavaScript, Flutter, or Swift clients, while the auth server handles redirects, code exchange, profile retrieval, and user creation or linking. Custom providers include default PKCE, authorization-parameter support, multi-platform audience validation through acceptable\_client\_ids, and an email\_optional setting for providers that do not return email addresses. They can be created, listed, updated, or deleted via the Dashboard or Admin API, with a limit of three per project.


### [Announcing Role Based Access Control in ClickStack](https://yomu.fyi/post/announcing-role-based-access-control-in-clickstack.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Author: Mike Shi
- Published: Apr 1, 2026
- Type: Announcement

Managed ClickStack has introduced Role-Based Access Control (RBAC) to replace a legacy model where all users shared identical instance-wide permissions or required duplicate HyperDX instances for isolation. Integrated with ClickHouse Cloud for identity management, the new system allows administrators to assign users to roles governed by three access tiers: no access, read, and manage. Permissions apply across platform resources including dashboards, saved searches, sources, alerts, webhooks, and notebooks, with support for fine-grained rules matching names, IDs, or tags. While table-level source restrictions work through ClickStack, row-level access currently depends on separate ClickHouse SQL console roles, which the team intends to unify directly inside ClickStack in future releases.


### [Provision a production-ready dev stack from your terminal](https://yomu.fyi/post/provision-a-production-ready-dev-stack-from-your-terminal.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: Rami Banna
- Published: Mar 26, 2026
- Type: Announcement

Stripe Projects, a new tool in the Stripe CLI, addresses the manual, fragmented work of turning a local prototype into a production-ready environment. It manages a project manifest and Stripe-backed record for attached services, provider accounts, and required credentials, while an integration protocol standardizes provisioning, plan selection, upgrades, and credential handoff. The developer preview supports services from providers including Vercel, Railway, Supabase, Neon, PlanetScale, Turso, Chroma, PostHog, Clerk, and Runloop; resources remain in accounts owned by the developer, and credentials can be synced to local development, CI, or a team secret manager. Through CLI commands such as stripe projects init, add, upgrade, and env --pull, developers or coding agents can repeat setup, audit changes, and upgrade supported plans using tokenized payment credentials, although payment handoff is limited to supported providers and plans in the US, EU, UK, and Canada.


### [Supabase Joins the Stripe Projects Developer Preview](https://yomu.fyi/post/supabase-joins-the-stripe-projects-developer-preview.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: gregor\_vand, ana\_mogul
- Published: Mar 19, 2026
- Type: Announcement

Supabase has joined the Stripe Projects developer preview, a Stripe CLI workflow for provisioning real services and obtaining working credentials with a single command. The integration provisions a complete Supabase project—including Postgres, Auth, Storage, Edge Functions, and Realtime—without requiring dashboard interaction, while supporting both developers and AI agents through deterministic, repeatable steps. After installing the Stripe CLI and adding supabase/project, stripe projects env --sync writes credentials to a local .env file and stores them in the Stripe Project for agent access; existing Supabase users can link their account. Projects remain in the user’s Supabase account with dashboard, connection-string, and data access, and database credentials can be rotated with stripe projects rotate supabase/project. The feature is a developer preview, and Stripe and Supabase are requesting feedback through Discord or GitHub.


### [ClickHouse Release 26.2](https://yomu.fyi/post/clickhouse-release-26-2.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Author: ClickHouse
- Published: Mar 16, 2026
- Type: Announcement

ClickHouse version 26.2 introduces twenty-five new features, forty-three performance optimizations, and one hundred eighty-three bug fixes across the database engine. This release graduates both the text-index and the QBit vector embedding data type to production-ready status for search and retrieval workloads. For streaming ingestion pipelines where row arrival rates are low, the engine adds time-based block flushing configurations to write data parts before hitting default row or byte thresholds. The update also embeds the ClickStack observability user interface directly into the standard binary distribution, accessible through the local HTTP server port. Further enhancements include automatic min-max indexing for temporal columns in MergeTree tables, interactive time-based one-time password authentication in the client, and a high-performance prime number generator function.


[Newer posts](https://yomu.fyi/topic/authentication/page/4.md) · [Older posts](https://yomu.fyi/topic/authentication/page/6.md)