Tag: #oauth2

← All posts

• Open Banking and MyData API Architecture — The Technology of Financial Data Openness

  The API architecture of Korean open banking shared network and MyData (personal credit information management). We cover standard API specs and auth tokens, comparison with UK Open Banking and the FAPI security profile,

  2026-06-13 · 16 min read #finance#open-banking#mydata#api#oauth2

• OpenID Connect Deep Dive — From the Authorization Code Flow to Discovery

  A protocol-level dissection of how OIDC stacks an authentication layer on top of OAuth 2.0: the role differences between ID Token, Access Token, and Refresh Token, and the detailed Authorization Code + PKCE flow with rea

  2026-06-12 · 14 min read #oidc#oauth2#jwt#sso#security

• FAPI 2.0 — A Complete Guide to the Financial-grade API Security Profile

  A thorough walkthrough of FAPI 2.0 Security Profile, the standard of the open banking and open data era. Covers the simplification from FAPI 1.0 to 2.0, the core requirements of PAR, PKCE, and sender-constrained tokens,

  2026-06-12 · 15 min read #fapi#oauth2#oidc#keycloak#security

• Refresh Token Rotation and Session Management — Designing a Theft-Resistant Token Lifecycle

  From access/refresh token lifetime design principles to rotation, reuse detection, and token family invalidation — we design a token lifecycle that assumes theft. We cover the three-layer model of IdP, app, and SSO sessi

  2026-06-12 · 16 min read #oauth2#session#keycloak#security#sso

• SSO Fundamentals — SAML vs OAuth 2.0 vs OIDC, What to Use and When

  A complete walkthrough of how SSO works (IdP/SP/RP), sessions vs tokens, and the history and role differences of SAML, OAuth 2.0, and OIDC. Includes a protocol decision tree, comparison tables, and real authentication fl

  2026-06-12 · 18 min read #sso#saml#oauth2#oidc#iam

• OAuth 2.1 Migration Guide — Designing Authentication in the Era of Mandatory PKCE

  A deep dive into the known weaknesses of OAuth 2.0 and how the OAuth 2.1 draft consolidates RFC 6749, RFC 7636, and RFC 9700 into a single spec. We cover why Implicit and ROPC were removed, how PKCE works, refresh token

  2026-06-12 · 17 min read #oauth2#oidc#security#pkce#sso

• OAuth Token Exchange (RFC 8693) — The Definitive Guide to Delegation and Propagation in Microservices

  How to solve the token propagation problem between microservices with RFC 8693 Token Exchange. Covers the difference between impersonation and delegation, request and response parameters, standard support in Keycloak 26.

  2026-06-12 · 15 min read #oauth2#keycloak#oidc#security#microservices

• Keycloak + Spring Security 6 Integration — Resource Server and OAuth2 Client in Practice

  A practical guide to integrating Keycloak with Spring Security 6 as an OAuth2 Resource Server and Client. Covers issuer-uri auto-configuration, mapping realm and client roles with JwtAuthenticationConverter, OIDC logout,

  2026-06-12 · 11 min read #keycloak#spring-security#oauth2#oidc#jwt

• Advanced OAuth Flows — When You Need CIBA, Device Flow, and DPoP

  A guide to advanced OAuth mechanisms for authentication scenarios that the standard redirect flow cannot solve. Covers the Device Authorization Grant (RFC 8628), CIBA with its poll/ping/push modes, the DPoP (RFC 9449) pr

  2026-06-12 · 15 min read #oauth2#oidc#keycloak#ciba#dpop

• Keycloak Authorization Services — Fine-Grained Access Control with UMA 2.0

  A deep dive into Keycloak Authorization Services that goes beyond the limits of RBAC. Covers the resource/scope/policy/permission model, the UMA 2.0 grant flow, policy enforcer configuration, decision strategies, and how

  2026-06-12 · 16 min read #keycloak#authorization#uma#oauth2#security

• 2026 IAM Trends — AI Agent Identity, MCP Authentication, Verifiable Credentials

  The 2026 IAM landscape is being reshaped by passwordless-by-default, an explosion of non-human identities in the form of AI agents, and the OAuth 2.1-based standardization of MCP authorization. From on-behalf-of delegati

  2026-06-12 · 16 min read #iam#oauth2#mcp#ai-agent#keycloak

• Building MCP Servers in Practice — How to Connect Your Tools to Every AI Agent

  A hands-on guide to building MCP (Model Context Protocol) servers, the de facto standard of 2026. We implement an internal wiki search server in TypeScript and Python, and cover tool design principles, OAuth 2.1 authenti

  2026-06-12 · 17 min read #mcp#ai-agent#typescript#python#oauth2

• SSO and Identity Providers in 2026 - A Deep Dive into Keycloak 26, Authentik, Authelia, Auth0, Okta, AWS Cognito, and Microsoft Entra ID ♪ Listenable

  A full survey of the SSO and Identity Provider landscape in 2026. Standards (OAuth 2.1, OIDC, SAML, SCIM, WebAuthn), open-source IdPs (Keycloak 26, Authentik, Authelia, Casdoor), managed SaaS (Auth0, Okta, AWS Cognito, M

  2026-05-16 · 24 min read #sso#iam#keycloak#authentik#authelia

• Keycloak vs Authentik vs Zitadel vs Ory Hydra vs Auth0 vs WorkOS vs Okta — 2026 SSO / OIDC / SAML / OAuth 2.1 / FAPI 2.0 / FedCM Deep Dive ♪ Listenable

  In 2026, OAuth 2.1 became an RFC, FAPI 2.0 went final and reached financial-services production, and Chrome and Edge shipped FedCM by default. Passkeys are no longer novel. This piece compares Keycloak 25, Authentik, Zit

  2026-05-16 · 21 min read #keycloak#authentik#zitadel#ory-hydra#auth0

• API & Web App Auth Libraries 2026 Deep Dive — Auth.js v5 · Lucia v3 · better-auth · Clerk · Stytch · WorkOS · Kinde · SuperTokens · Frontegg ♪ Listenable

  In 2026 the build-vs-buy line for web app auth is sharper than ever. From libraries like Auth.js v5, Lucia v3, and better-auth to managed SaaS like Clerk, Stytch, WorkOS, Kinde, SuperTokens, and Frontegg — this deep dive

  2026-05-16 · 24 min read #english#auth-libraries#auth-js#lucia#better-auth

• Keycloak Integration Hands-On — Run It with Docker, Configure Realm/Client, Wire Up Spring Boot and Next.js (2025 Hands-On Guide) ♪ Listenable

  Don't build authentication yourself — use Keycloak. This is a follow-along hands-on: run Keycloak 26 with Docker, configure Realm/Client/User/Role, poke the OIDC endpoints with curl, and integrate a Spring Boot Resource

  2026-05-14 · 23 min read #keycloak#oidc#oauth2#authentication#authorization

• Frontend Security 2025 — XSS, CSRF, CSP, Trusted Types, JWT, OAuth, PKCE, Passkeys, Supply Chain, SRI (S6 E9)

  XSS still tops every CVE report. But 2024–2025 shipped real tools to defeat it: Trusted Types, CSP v3 with strict-dynamic, Sanitizer API. Passkeys replaced passwords for serious products. Supply-chain attacks made SRI +

  2026-04-15 · 6 min read #frontend#security#xss#csrf#csp

• OAuth 2.0 & OIDC Deep Dive — Authorization Code, PKCE, JWT, DPoP, FAPI (2025)

  OAuth 2.0 and OIDC run billions of times daily, yet most developers understand them only superficially. This guide dissects them from scratch: the four OAuth 2.0 flows, why PKCE became mandatory, JWT structure and pitfal

  2026-04-15 · 13 min read #oauth2#oidc#openid-connect#authentication#authorization

• OAuth 2.0 & Authentication Complete Guide 2025: JWT, Sessions, SSO, OIDC, Passkey

  Everything about web authentication! OAuth 2.0 flows (Authorization Code/PKCE/Client Credentials), JWT (structure/verification/Refresh Token), Session vs Token, SSO (SAML/OIDC), Passkey (WebAuthn/FIDO2), Social Login, Se

  2026-03-25 · 22 min read #oauth2#authentication#jwt#session#sso

• OAuth2 & JWT Complete Guide: Everything About Authentication and Authorization for Developers ♪ Listenable

  Everything about OAuth2 and JWT with practical code! Authorization Code/PKCE/Client Credentials flows, JWT structure and signature verification, Access/Refresh Token strategies, Session vs Token comparison, OIDC, securit

  2026-03-23 · 23 min read #oauth2#jwt#authentication#authorization#security