--- title: "OAuth2" description: "14 posts about OAuth2, summarised, each linking to the original." --- # OAuth2 > 14 posts about OAuth2, summarised, each linking to the original. ## Articles ### [Announcing DPoP Support for Google OAuth: Securing Refresh Tokens](https://yomu.fyi/post/announcing-dpop-support-for-google-oauth-securing-refresh-tokens.md) - Company: [Google](https://yomu.fyi/company/google.md) - Author: Sergei Akulich, Brian Daugherty - Published: Oct 15, 2026 - Type: Announcement Google announced DPoP (RFC 9449) support for its OAuth platform, specifically binding refresh tokens to a client-generated asymmetric keypair to neutralize token theft and replay attacks from Infostealer malware and AiTM threats. Access tokens remain standard bearer tokens to avoid the per-request asymmetric cryptographic verification overhead on high-QPS APIs like Gmail and Drive, delivering a pragmatic tradeoff between security and performance. The implementation follows RFC 9700 best practices for sender-constrained refresh tokens and is recommended for Backend-for-Frontend (BFF) and Token-Mediating Backend architectures. DPoP operates at the HTTP header level, making it resilient in multi-hop environments such as Model Context Protocol (MCP) agent chains, though multi-agent delegation requires Google Cloud Secure Token Service (STS) to preserve key isolation. Complementary protections against cookie theft are offered by Device Bound Session Credentials (DBSC), which cryptographically binds browser session cookies to device hardware for a defense-in-depth strategy. ### [Making it easier to build on Intercom - The Intercom Blog](https://yomu.fyi/post/making-it-easier-to-build-on-intercom-the-intercom-blog.md) - Company: [Intercom](https://yomu.fyi/company/intercom.md) - Published: Oct 9, 2026 - Type: Announcement Intercom announced platform updates to make it easier for developers to build integrations and automate workflows, reflecting its commitment to supporting unexpected business use cases. The Acquire API now provides full API and webhooks support for logged-out users (Contacts), including creating, converting, and merging Contacts and Users. The Conversations API has been expanded to support initiating, replying, opening, closing, assigning conversations, and sending attachments. Intercom now maintains official client libraries for Ruby, Node.js, PHP, Java, and Go, with community-contributed clients for Haskell, Python, and Perl, downloaded approximately 300,000 times. Additional improvements also include a Stripe integration for syncing user data and live events, a fully asynchronous Bulk API for large operations, a WordPress plugin, and OAuth support initially in the Salesforce integration, while third-party apps like AskNicely, Gini, and Talkdesk have built on the platform for NPS tracking, reports, and phone call management. ### [Build a Secure TypeScript MCP Client with Cross App Access (XAA)](https://yomu.fyi/post/build-a-secure-typescript-mcp-client-with-cross-app-access-xaa.md) - Company: [Okta](https://yomu.fyi/company/okta.md) - Author: Akanksha Bhasin - Published: Oct 9, 2026 - Type: Tutorial The post presents a tutorial for building a TypeScript Model Context Protocol (MCP) client that uses Cross App Access (XAA) to securely bridge enterprise apps across trust domains. The sample app is an employee onboarding dashboard that signs in through an identity provider, exchanges identity for an Identity Assertion JWT Authorization Grant (ID-JAG), trades it for an access token, and fetches data from a protected MCP server. The tutorial uses the MCP TypeScript SDK’s CrossAppAccessProvider to automate the four-step XAA flow, including token exchange and retry on 401 responses. Developers test against xaa.dev, a free playground that hosts the IdP, authorization server, and a todo MCP server. The post explains key concepts like ID-JAG claims, separate client credentials per trust domain, and how XAA enables AI agents and enterprise apps to act on behalf of users without OAuth consent screens. ### [September 2026 Fraud Update: Phishing Trends, Third-party Safety and Latest Releases](https://yomu.fyi/post/september-2026-fraud-update-phishing-trends-third-party-safety-and-lat.md) - Company: [Twilio](https://yomu.fyi/company/twilio.md) - Author: Dan Nieters, Rohit Agarwal, Alena Eissman - Published: Oct 8, 2026 - Type: Announcement Twilio’s Q3 2026 fraud update covers phishing trends, third-party safety, and new releases. Over 80% of phishing originating from SendGrid was due to account takeovers, with attacks centered on delivery service spoofing, invoice fraud, and targeted Japanese campaigns impersonating brands like Amazon and Mercari. Attackers used fabricated forwarded threads, typosquatted domains like tvvilio\[.\]org, familiar names, AI-generated email templates, and associated phone calls, sometimes spoofing Twilio’s help line. To secure third-party integrations, Twilio recommends scoping access strictly, practicing credential hygiene, and reviewing audit integrations regularly, and now recommends OAuth 2.0 Client Credentials over auth tokens or API keys for scoped short-lived tokens. New releases include IP ACL with Dry Run mode, which logs blocked requests without enforcement to prevent accidental lockouts before real enforcement. ### [Introducing IdentiFlows.dev: A Visual Reference for Identity Flows](https://yomu.fyi/post/introducing-identiflows-dev-a-visual-reference-for-identity-flows.md) - Company: [Auth0](https://yomu.fyi/company/auth0.md) - Author: Andrea Chiarelli - Published: Sep 29, 2026 - Type: Announcement Developers often struggle to quickly find accurate sequence diagrams for OAuth 2.0 and OpenID Connect flows. IdentiFlows.dev is a new website that provides a visual reference for common identity protocols, organized into four categories. Each flow page includes an introduction explaining the flow’s purpose, a sequence diagram showing the full exchange, and a step-by-step breakdown of each stage, with an interactive mode to walk through the steps. The initial release covers eight flows, including OAuth 2.0 Authorization Code with PKCE, the recommended login flow for most modern apps, SAML 2.0 SP-Initiated SSO, DPoP-Bound Access Token requests, and OpenID Connect Discovery. The project is an early release with plans to add more flows like Client Credentials, Device Authorization, and WebAuthn, and the author invites feedback to guide development. ### [Adding Google Login to a React App with Auth0](https://yomu.fyi/post/adding-google-login-to-a-react-app-with-auth0.md) - Company: [Auth0](https://yomu.fyi/company/auth0.md) - Author: Carla Urrea Stabile - Published: Sep 11, 2026 - Type: Tutorial The tutorial shows how to add Google login to a Vite-based React single-page app without implementing OAuth directly, using Auth0’s React SDK and Google social connection. It covers installing @auth0/auth0-react, creating an Auth0 Single Page Web Application, checking RS256 and OIDC Conformant settings, registering callback, logout, and web-origin URLs, and supplying the domain and client ID through Vite environment variables. The React code wraps the app in Auth0Provider, uses useAuth0 for loading and authentication state, and calls loginWithRedirect with connection: 'google-oauth2' to bypass provider selection. For production, it explains replacing Auth0’s shared development keys with Google Cloud credentials whose origin and redirect URI target the Auth0 domain, then storing them in the Auth0 social connection. It also points to route protection with withAuthenticationRequired, API access tokens from getAccessTokenSilently, and exact redirect-URI matching as important follow-on considerations. ### [Five Reasons Why Your Auth0 Permissions Are Not in your Access Token](https://yomu.fyi/post/five-reasons-why-your-auth0-permissions-are-not-in-your-access-token.md) - Company: [Auth0](https://yomu.fyi/company/auth0.md) - Author: Carla Urrea Stabile - Published: Sep 3, 2026 - Type: Explainer Auth0 access tokens can lack a permissions claim despite apparently configured RBAC, and the post identifies five silent causes. The authorization request may omit the API audience, the API’s “Add Permissions in the Access Token” setting may be disabled, or a permission-bearing role may not be assigned to the user, including at the relevant organization level. Developers may also be decoding an ID token rather than the API access token, whose aud identifies the API. Client Credentials tokens represent applications rather than users and typically carry granted scopes instead of a permissions array. For custom Post-Login claims, the post advises using a namespaced claim rather than colliding with Auth0’s reserved permissions claim. ### [MongoDB for the Agentic Era: Built for Developers and AI Agents](https://yomu.fyi/post/mongodb-for-the-agentic-era-built-for-developers-and-ai-agents.md) - Company: [MongoDB](https://yomu.fyi/company/mongodb.md) - Published: Aug 13, 2026 - Type: Announcement MongoDB has launched the Atlas Managed MCP Server, a fully hosted service that lets AI coding tools connect to Atlas data without manual infrastructure setup. The server uses OAuth 2.1 to replace shared service accounts with individual user delegation, so agents act with the developer’s own permissions and every action is auditable. Developers can connect via one-click OAuth consent in tools like Claude Code, Codex, Cursor, Grok Build, and Devin AI, with no connection strings or credentials to manage. Admins can enforce read-only mode, configure token lifetimes, and revoke access from the Atlas UI or Admin API. The announcement also includes Atlas App Connections, native connectors for frontier AI tools, and an integration with Vercel v0, aiming to close the gap between prototype and production. ### [Introducing xaa.dev: A Playground for Cross App Access](https://yomu.fyi/post/introducing-xaa-dev-a-playground-for-cross-app-access.md) - Company: [Okta](https://yomu.fyi/company/okta.md) - Author: Sohail Pathan - Published: Jan 20, 2026 - Type: Announcement xaa.dev is a free, beta playground for exploring Cross App Access (XAA) end to end without local setup, infrastructure provisioning, or signup. It addresses the difficulty of testing XAA, which otherwise requires configuring an Identity Provider, resource authorization server, resource API, and requesting application before a token exchange can be observed. The site pre-configures these roles and guides users through authentication, token exchange, access token request, and resource access while exposing requests, responses, and cryptographic claims. Developers can also connect their own apps, including MCP clients, and test both OIDC and SAML identity assertions; it is currently in beta and requires no account. ### [Secure Authentication with a Push Notification in Your iOS Device](https://yomu.fyi/post/secure-authentication-with-a-push-notification-in-your-ios-device.md) - Company: [Okta](https://yomu.fyi/company/okta.md) - Author: Darko Spasovski - Published: Nov 18, 2025 - Type: Tutorial The tutorial shows how to build a native iOS sign-in flow using Okta DirectAuth and push notification MFA. It starts with an Okta Integrator Free Plan org, configures an OIDC Native Application and enables Okta Verify push notifications, while noting additional authorization policies may be required for a custom authorization server. In Xcode, the app uses Swift, SwiftUI, Swift Package Manager, and the Okta mobile Swift packages OktaDirectAuth and AuthFoundation to handle credentials, tokens, and MFA challenges without browser redirects. An AuthService coordinates authentication state, user and token information, sign-out, access-token refresh, and session restoration from stored credentials. The completed flow is described as phishing-resistant and able to maintain an active session directly within a SwiftUI app. ### [Create a React PWA with Social Login Authentication](https://yomu.fyi/post/create-a-react-pwa-with-social-login-authentication.md) - Company: [Okta](https://yomu.fyi/company/okta.md) - Author: Emmanuel Jesulayomi Folaranmi - Published: Jul 22, 2025 - Type: Tutorial The tutorial builds a React Progressive Web App (PWA) called Lister, combining offline support with authentication through Okta and Google Social Login. It creates an Okta OIDC single-page application, configures Authorization Code and Refresh Token grants, sets localhost redirect URIs, and wires Okta React and AuthJS into React Router routes. The implementation uses environment variables for the Okta domain and client ID, OAuth 2.0 and OpenID Connect scopes including openid, profile, email, and offline\_access, and a Vite PWA plugin to provide a manifest, service worker, and installable behavior. Authenticated users receive a todo-list interface with CRUD operations, while the article notes that production deployments would need more advanced service-worker configuration and a proper database. ### [Notion’s hosted MCP server: an inside look](https://yomu.fyi/post/notion-s-hosted-mcp-server-an-inside-look.md) - Company: [Notion](https://yomu.fyi/company/notion.md) - Author: Kenneth Sinder - Published: Jul 15, 2025 - Type: Explainer Notion’s hosted Model Context Protocol (MCP) server describes its move from a downloadable MCP server to an all-in-one hosted service that lets AI clients such as Cursor and Claude Desktop interact with workspaces. The initial proof of concept generated MCP tools from Notion’s OpenAPI schema, mapping endpoints one-to-one to API calls, but setup required API keys or Docker and the approach consumed substantial context when handling hierarchical block JSON. The hosted version uses a code-generation pipeline that converts OpenAPI schemas to Zod, combines rewritten AI-oriented tools with wrappers for existing v1 APIs, and exposes them through a central integration. Users connect through one-click OAuth; the server manages sessions and tokens, with streamable HTTP and SSE supported for client compatibility. A design change is Notion-flavoured Markdown, which represents blocks including callouts, columns, pages, and databases more efficiently for agent conversations, while semantic search can span Notion and over ten third-party apps. ### [Superheroes, Startups, and Security: Sohail's Path to Developer Advocacy at Okta](https://yomu.fyi/post/superheroes-startups-and-security-sohail-s-path-to-developer-advocacy.md) - Company: [Okta](https://yomu.fyi/company/okta.md) - Author: Sohail Pathan - Published: Jun 16, 2025 - Type: Announcement Sohail Pathan describes his path from Android development to a Senior Developer Advocate role at Okta, tracing how curiosity about technology grew into community and developer relations work. After studying Computer Science and adopting Kotlin for Android app projects, he moved from an EdTech startup’s Android team into its first Developer Community Manager role, organizing meetups, answering forum questions, and supporting learners. At a deeptech startup, he led Developer Relations for a cloud-based Android Studio tool, using meetups, hackathons, and feedback to seek product-market fit before technical roadblocks and limited demand forced closure after four months. At ApyHub, he created Go and Node.js tutorials, sample apps, API documentation, and community programs while gaining hands-on experience with REST architecture, microservices, API gateways, containers, load balancing, DevOps, OAuth, and identity management. He says that exposure led him to Okta, where he plans to share API and identity knowledge with its community. ### [Tokenized Tokens](https://yomu.fyi/post/tokenized-tokens.md) - Company: [Fly.io](https://yomu.fyi/company/fly-io.md) - Published: Jul 12, 2023 - Type: Problem & solution Fly.io describes a security problem in its Rails-based platform: as the application accumulated secrets, Rails became the part of the attack surface least trusted, yet still handled many operations involving bearer tokens. It compares model encryption, Vault or KMS, and narrowly scoped secret-handling services, noting that each leaves gaps or creates operational overhead when secrets must be read for arbitrary third-party APIs. The proposed Tokenizer is a stateless HTTP proxy holding a Curve25519 private key; encrypted secrets travel in Proxy-Tokenizer headers, and the proxy injects plaintext or computes HMACs while host allowlists constrain misuse. A companion SSOkenizer performs OAuth2 flows outside Rails, tokenizes resulting bearer tokens, and returns credentials usable only through Tokenizer. The tools are open source, and the design provides a path for third-party integrations and SSO without adding raw secrets to Rails.