Deploying Logto as a GCP Identity Platform Alternative
Google Cloud Identity Platform is Google's managed CIAM service for web and mobile applications, providing user account management, customizable aut…
Architecture
⚑ Report a ProblemLatest Architecture news from Tech News
All topics
agents
ai
api
architecture
automation
aws
backend
beginners
career
database
devchallenge
devops
javascript
llm
machinelearning
mcp
news
opensource
performance
productivity
programming
python
react
security
showdev
softwareengineering
systemdesign
tutorial
typescript
webdev
Deploying Logto as an AWS Cognito Alternative
AWS Cognito is Amazon's managed authentication service for web and mobile applications, providing User Pools, Identity Pools for federated AWS resou…
Deploying Ory Hydra: An Open-Source OAuth 2.0 and OpenID Connect Server
Ory Hydra is an open-source OAuth 2.0 Authorization Server and OpenID Connect (OIDC) provider. Unlike identity platforms that bundle user management…
AI Agent Authentication in 2026: Web Bot Auth, ARD & OAuth
AI agent authentication is not one protocol. It is a stack. An agent may need to discover a tool, prove which workload is running, authenticate an H…
Best MCP Servers in 2026: One Pick Per Category
Originally published on DevToolHub . The best MCP servers in 2026 aren't just the ones with the most GitHub stars. With the 2026-07-28 spec update —…
How to Compare OAuth vs Native Credentials: Identity Ownership and Session Tradeoffs
Short answer: for a property-management portal, let Google and GitHub prove identity, but keep account ownership, session issuance, and revocation i…
Supercharging DeepSeek Harness: Bringing Claude Pro/Max with One-Click Google/Gmail OAuth Login and Real-Time Quota Tracking
By **grloper * ( GitHub @grloper )* 1. Introduction: The Subscription Dilemma in Modern Agent Frameworks DeepSeek Harness (DSH) has quickly establis…
The confused deputy, or why "just forward the token" breaks your MCP server
Here is a failure that does not look like a bug in code review, passes every test you wrote, and quietly hands an attacker your privileges. It is ca…
Twitch Accepts Invalid Keys and Silently Discards Them — The Hidden Pitfalls of Integration and a 41-Second Recovery
📝 Originally published (in Japanese) at forge.workstyle.tech . Building an AI Avatar Live Streaming System That Runs Unattended When building an AI…
У OpenID-сервера появился второй транспорт: gRPC рядом с HTTP, на тех же маршрутах
redb.Identity получил gRPC-фасад: те же маршруты ядра, тот же реестр клиентов, один токен на оба транспорта. Что внутри, как включить, что померить.…
How I Handle OAuth2 Token Refresh and Quotas in a Django API Gateway
My first post about Asstgr covered the "what" — a self-hosted gateway that lets you register third-party APIs and call them through one unified inte…
Patient Portal Login With Convenient Authorization and Explicit Data Consent
Use delegated login for authentication convenience, but record patient consent as a separate, versioned domain event inside the portal. The deciding…
Trusted AI Agent Transactions, Part 2: PingFederate Token Exchange
Using PingFederate as a Transaction Token Service Part 1 separated the user, logical agent, runtime workload, agent execution, and transaction ident…
Trusted AI Agent Transactions, Part 1: The Identity Problem
The identity problem behind AI agents An application that calls an API for a user normally answers one identity question: who is the user? An AI age…
Don't Hand Your Inbox to an Agent
A Reddit thread on connecting Claude Code to a Yahoo Mail account turned into a solid field guide for scoping down what an AI agent is allowed to to…
How I built the Appwrite MCP server (and decided to hide most of its capabilities)
When Anthropic introduced the Model Context Protocol on November 25, 2024, it got everyone's eyes on it, including Christy, who was Appwrite's Engin…
A Practical Guide to Using Auth0 as an Identity Broker for Epic SMART on FHIR
Your team already uses Auth0. Now someone wants to add Epic. On paper, it looks like one more enterprise connection — Epic speaks OAuth 2.0 and Open…
Token Revocation Is Not an Endpoint
I recently wrote a sentence I need to correct: “DPoP stops replay. The gap most teams miss is revocation lag once the token walked.” The second half…
One login to rule them all: centralized auth for internal tools with Caddy
I am lazy. Not in the "I don't want to work" sense 1 , but in the "I refuse to solve the same problem twice" sense. So when I found myself looking a…
What is OpenIddict: the .NET framework developers choose for OAuth 2.0 and OpenID Connect
I've been writing a short series on OpenIddict basics while preparing IdentitySuite's v3.0 release — here's part 1. The .NET framework developers ch…
Mastering Symfony Security, Passports and Custom Authenticators
Security is the cornerstone of any modern web application, but historically, implementing robust authentication and authorization mechanisms has bee…
Production Android Auth: OAuth2, PKCE & KeyStore Security
Most Android authentication tutorials stop at “getting the token”. But in real production systems (especially fintech apps), that’s just the beginni…
Stop Storing Passwords: Build Enterprise SSO in Laravel 🛡️
Passwords are a Technical Liability When building a B2B SaaS platform at Smart Tech Devs, the default instinct is to scaffold standard email and pas…
Salesforce ECA Security Compliance for AppExchange ISVs: A Technical Breakdown of the Four OAuth Controls
If you received Salesforce’s mandatory security email in late April 2026 and immediately started questioning which of the four OAuth controls actual…
The Silent Backdoor in Enterprise Security: Why Unmanaged OAuth Tokens Are the New High-Risk Vector
The rapid adoption of AI productivity tools is exposing a dangerous blind spot in enterprise security architecture. Organizations invest heavily in…