How I Handle OAuth2 Token Refresh and Quotas in a Django API Gateway
My first post about Asstgr covered the "what" — a self-hosted gateway that lets you register third-party APIs and call them through one unified inte…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
AI
Gear
News
Tech
agents
ai
api
architecture
automation
beginners
career
database
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
Patient Portal Login With Convenient Authorization and Explicit Data Consent
Use delegated login for authentication convenience, but record patient consent as a separate, versioned domain event inside the portal. The deciding…
Trusted AI Agent Transactions, Part 2: PingFederate Token Exchange
Using PingFederate as a Transaction Token Service Part 1 separated the user, logical agent, runtime workload, agent execution, and transaction ident…
Trusted AI Agent Transactions, Part 1: The Identity Problem
The identity problem behind AI agents An application that calls an API for a user normally answers one identity question: who is the user? An AI age…
Don't Hand Your Inbox to an Agent
A Reddit thread on connecting Claude Code to a Yahoo Mail account turned into a solid field guide for scoping down what an AI agent is allowed to to…
We shipped a one-click 'Add to Cursor' button. The hard part wasn't the button.
My job is getting our product into people's hands. It's built for AI agents, so it has to live where agents pick up their tools — in their catalogs.…
How I built the Appwrite MCP server (and decided to hide most of its capabilities)
When Anthropic introduced the Model Context Protocol on November 25, 2024, it got everyone's eyes on it, including Christy, who was Appwrite's Engin…
A Practical Guide to Using Auth0 as an Identity Broker for Epic SMART on FHIR
Your team already uses Auth0. Now someone wants to add Epic. On paper, it looks like one more enterprise connection — Epic speaks OAuth 2.0 and Open…
Sign in with Apple broke with invalid_client after 6 months? Here's why — and how to never deal with it again
If you're here because Apple login on your production app suddenly started failing with invalid_client — and you changed nothing — this post is for…
Token Revocation Is Not an Endpoint
I recently wrote a sentence I need to correct: “DPoP stops replay. The gap most teams miss is revocation lag once the token walked.” The second half…
OAuthSonas: A Tiny OpenID Connect Provider for Playwright E2E Tests
If you've ever wired up end-to-end tests for an app that uses OpenID Connect, you've probably done one of these: stubbed the OIDC library entirely a…
One login to rule them all: centralized auth for internal tools with Caddy
I am lazy. Not in the "I don't want to work" sense 1 , but in the "I refuse to solve the same problem twice" sense. So when I found myself looking a…
Giving an AI assistant read-only access to Microsoft Loop — without breaking permissions
Giving an AI assistant read-only access to Microsoft Loop — without breaking permissions I wanted my AI assistant to read my team's Microsoft Loop p…
What is OpenIddict: the .NET framework developers choose for OAuth 2.0 and OpenID Connect
I've been writing a short series on OpenIddict basics while preparing IdentitySuite's v3.0 release — here's part 1. The .NET framework developers ch…
MCP clients can't easily authenticate with Entra. Here's the bridge.
If you work in a company using AI and MCPs, you put an MCP server on the network. You realize you need auth. The easy path is an API key, you go and…
How to Test OAuth Recovery Emails Without Exposing Real Inboxes
OAuth recovery emails look harmless until you test them the lazy way. A team sends password reset links or recovery codes into one shared mailbox, c…
OAUTH2.0 In Action — A Guide To Implementing OAUTH In Apps and Websites.
Table of contents What is OAUTH A trip to OAUTH1.0Ville What is OAUTH2.0 Examples of OAUTH Technology OIDC Hands-on Implementation with Microsoft En…
Passwords are not necessary, a Oauth/OIDC approach
Intro It is possible to skip the burden of password management, security, encryption and password rotations. When using OAuth 2.0 with OIDC (OpenID…
Four Bugs Stood Between Me amd "Sign in with Google"
Summary: I had a rough time adding Google login to my app, Kenning. It took me a while to figure out four issues that were causing problems. These i…
GitHub ships a one-click self-revoke for users whose credentials just leaked
You forwarded the phishing email to the security channel about ninety seconds too late. The laptop is already cooperating with someone else. Your pe…
An AI agent acted across two companies. Whose audit log knows which human?
Here is a setup that is going to be normal soon, if it isn't already. Alice logs into her company's tools through their identity provider. She point…
Mastering Symfony Security, Passports and Custom Authenticators
Security is the cornerstone of any modern web application, but historically, implementing robust authentication and authorization mechanisms has bee…
Auth in Next.js SaaS starters: redirect loops, OAuth callbacks, magic links, and session drift
A practical guide to auditing authentication in a Next.js SaaS starter before it breaks across preview URLs, production domains, and protected route…
Production Android Auth: OAuth2, PKCE & KeyStore Security
Most Android authentication tutorials stop at “getting the token”. But in real production systems (especially fintech apps), that’s just the beginni…
Outlook.com Is the Final Boss of 'Just Send an Email'
Every email project starts with a lie: "I'll just test it with SMTP real quick." That was my plan while working on EpicMail . I wanted a boring, rep…
Stop Storing Passwords: Build Enterprise SSO in Laravel 🛡️
Passwords are a Technical Liability When building a B2B SaaS platform at Smart Tech Devs, the default instinct is to scaffold standard email and pas…
How to set up refresh-token-only OAuth for a multi-tenant Apify Actor (Gmail, 10 minutes)
How to set up refresh-token-only OAuth for a multi-tenant Apify Actor (Gmail, 10 minutes) If you're shipping an Apify Actor that calls a per-user Go…
Supabase's Management API OAuth Endpoint Switches From 201 to 200 on May 26 — Here's What Silently Breaks
On May 26, 2026, the OAuth token exchange endpoint for Supabase's Management API — https://api.supabase.com/v1/oauth/token — will stop returning 201…
Sign In With LinkedIn Using OpenID Connect in Next.js 16
LinkedIn finally moved Sign In to OpenID Connect a while back. Most of the tutorials still floating around the internet show the legacy v1 OAuth dan…
Salesforce ECA Security Compliance for AppExchange ISVs: A Technical Breakdown of the Four OAuth Controls
If you received Salesforce’s mandatory security email in late April 2026 and immediately started questioning which of the four OAuth controls actual…