How to Send Auth Codes via WhatsApp in Your App With Kinde
Your users are in San Francisco, Jakarta, São Paulo, and Sydney. They have WhatsApp open all day. They check it before they check their SMS inbox. Whe…
Tech news from the best sources
Your users are in San Francisco, Jakarta, São Paulo, and Sydney. They have WhatsApp open all day. They check it before they check their SMS inbox. Whe…
Here is something most developers shipping SMS OTP in 2026 do not want to sit with: the channel they are trusting to verify their users is failing rou…
Authentication answers "who are you?" Authorization answers the harder question: "are you allowed to do this?" By the time a request reaches this stag…
In the first four chapters of this series I've talked about what the Auth Gateway decides. This chapter is about who it decides for. We run a multi-te…
In Chapter 3 the controller branched on something called the "endpoint type": switch endpointType ( perms ) { case "OPEN" : ... case "AUTHENTICATED" :…
Most auth services start simple — verify the token, return 200 or 401. Then requirements accumulate. Tenant isolation. Service accounts. Token revocat…
If you've been on a platform team long enough, you've probably watched this slow-motion failure: You ship an auth library. Three services adopt it. Si…
In Chapter 1 I claimed our entire Auth Gateway is built on top of one NGINX directive: auth_request . This chapter is a deep dive into how that direct…