#Authentication

Articles about Authentication — exploring patterns, best practices, and real-world implementations in production systems.

11 posts tagged with authentication. ← All posts

#A2A (14)#ADK (8)#AG-UI (6)#AI (9)#AI Agents (311)#AI Architecture (21)#AI Cost (10)#AI Cost Optimization (8)#AI Engineering (227)#AI Evaluation (9)#AI Gateway (8)#AI Governance (29)#AI Red Teaming (9)#AI Research (9)#AI Safety (8)#AI Security (29)#AI in Production (12)#AML (3)#API Design (10)#API Security (8)#APIs (56)#AWS (17)#Accounting (9)#Agent Skills (3)#Agentic AI (24)#Agentic Commerce (12)#Agentic RAG (8)#Agents (4)#Amazon Bedrock (8)#Analytics (3)#Architecture (40)#Audit (3)#Authentication (11)#Authorization (3)#Automation (8)#Azure (11)#Azure AI Foundry (9)#Backend Engineering (310)#Benchmarks (3)#Best Practices (3)#BigQuery (6)#Business Finance (8)#Business Strategy (55)#C (8)#CI/CD (16)#Caching (11)#Capital Markets (14)#Card Payments (12)#Cards (13)#Career (25)#Checkpointing (4)#Claude Code (8)#Cloud (5)#Cloud Architecture (3)#Cloud Native (10)#Code Review (8)#Collaboration (5)#Communication (9)#Compliance (52)#Computer Networking (9)#Computer Science (32)#Computer Vision (5)#Concurrency (39)#Consulting (3)#Containers (10)#Context Engineering (10)#Conversational AI (8)#Cost Optimisation (5)#Credit (14)#Credit Risk (14)#CrewAI (8)#Crypto (12)#Cryptocurrency (12)#Cryptography (8)#Custody (9)#DSPy (8)#Data (13)#Data Engineering (12)#Data Structures (9)#Databases (38)#Deployment (4)#Design Patterns (10)#DevOps (24)#DevSecOps (21)#Developer Experience (5)#Developer Tools (5)#Distributed Systems (95)#Documentation (3)#Edge AI (8)#Embeddings (17)#Emotional Intelligence (8)#Energy (8)#Engineering (11)#Engineering Culture (3)#Engineering Practices (16)#Error Handling (4)#Evaluation (58)#Event-Driven Architecture (8)#FREE-AI (8)#FX (5)#Feedback (4)#FinOps (23)#FinTech (6)#Financial AI (14)#Financial Systems (129)#Fine-Tuning (11)#Fintech (131)#Flutter (8)#Foreign Exchange (5)#Forward Deployed Engineer (16)#Forward Deployed Engineering (8)#Fraud (10)#Function Tools (5)#Functional Programming (3)#Fundraising (8)#GCP (5)#Gemma (4)#Generative AI (3)#Git (8)#Go (220)#Go-to-Market (8)#Google ADK (36)#Governance (59)#Granite (6)#GraphQL (3)#Growth (3)#Guardrails (33)#HIPAA (3)#HTTP (3)#Harness Engineering (8)#Hiring (8)#Hugging Face (8)#Human-in-the-Loop (9)#IBM watsonx (8)#Identity (11)#Integration (3)#Intellectual Property (8)#Interfaces (3)#JavaScript (8)#KYC (11)#KYC and AML (12)#Kafka (10)#Kubernetes (17)#LLM (5)#LLM Inference (8)#LLM Infrastructure (8)#LLM-as-Judge (3)#LLMs (170)#LangChain (8)#LangGraph (11)#Leadership (26)#Ledger (12)#Legal (8)#Lending (14)#Linux (9)#LlamaIndex (8)#Load Balancing (3)#MCP (22)#MLOps (32)#Machine Learning (49)#Marketing (16)#Markets (4)#Memory (15)#Memory Management (5)#Metrics (6)#Microservices (3)#Microsoft Agent Framework (150)#Middleware (6)#Migration (9)#Mixture of Experts (5)#Monitoring (3)#Multi-Agent (10)#Multi-Agent AI (14)#Multi-Agent Systems (73)#Multimodal (3)#Multimodal AI (8)#NIM (5)#NVIDIA (8)#Networking (3)#OAuth (3)#OWASP (7)#Observability (49)#On-Device AI (8)#Open Source (7)#OpenTelemetry (5)#Operating Systems (9)#Operations (10)#Opinion (6)#Orchestration (10)#Organizational Design (8)#Payment Rails (16)#Payments (54)#People (8)#Performance (48)#Personalization (9)#Platform Engineering (9)#PreSales (8)#Privacy (5)#Privacy Engineering (3)#Process (4)#Product (29)#Product Management (8)#Production (11)#Programming (10)#Programming Languages (48)#Prompt Engineering (74)#Prompt Injection (14)#Protocol Buffers (3)#Protocols (9)#Providers (4)#Pydantic AI (8)#Python (142)#Quality (3)#RAG (59)#RBI (3)#REST (5)#Rails (16)#Reasoning Models (8)#Recommender Systems (8)#Reconciliation (3)#RegTech (8)#Regulation (9)#Reliability (52)#Resilience (4)#Responsible AI (5)#Retrieval (3)#Risk (13)#Rust (32)#SLSA (3)#SRE (22)#Sales (9)#Scalability (3)#Security (91)#Security Engineering (8)#Self-Evolving Agents (16)#Sessions (3)#Settlement (9)#Soft Skills (8)#Software (3)#Software Architecture (36)#Software Delivery (9)#Software Engineering (144)#Spanner (4)#Speech (8)#Startups (30)#Strands (8)#Streaming (31)#Structured Output (4)#Supply Chain Security (9)#Sustainability (8)#System Design (32)#Systems Programming (56)#Testing (53)#Threat Modeling (3)#Tool Use (22)#Tooling (5)#Tools (3)#Trading (8)#Treasury (6)#Type System (3)#Type Systems (11)#TypeScript (8)#Vector Databases (22)#Vector Search (11)#Venture Capital (8)#Version Control (8)#Voice AI (9)#Web Development (6)#Workflows (14)#eBPF (8)#gRPC (13)#smolagents (8)
Pratik Dhanave · ·6 min read

Securing Identity in Practice

Identity is the front door to everything, which makes it the most attacked part of most systems and the place where a single mistake compromises everyone. The protocols are secure by design — but only if you use them correctly, and the failures are remarkably consistent: skipped validations, mishandled tokens, and doing yourself what a library should do. This closing post is the practical security checklist.

Identity is the front door to everything, which makes it the most attacked part of most systems. The protocols are secure by design — but only if you use them correctly, and the failures are remarkably consistent: skipped validations, mishandled tokens, and rolling your own.

#Identity#Security#Authentication#AppSec
Pratik Dhanave · ·7 min read

Sessions, Single Sign-On, and Logout

Logging a user in is the easy part; keeping them logged in — and, harder than anyone expects, logging them out — is where identity gets subtle. Sessions bridge stateless requests into a continuous identity, single sign-on shares that identity across apps, and single logout is a genuinely hard problem that most systems get partly wrong.

Logging a user in is the easy part; keeping them logged in — and, harder than anyone expects, logging them out — is where identity gets subtle. Single logout is a genuinely hard problem that most systems get partly wrong.

#Identity#Security#Web Development#Authentication
Pratik Dhanave · ·6 min read

SAML: Enterprise Single Sign-On

SAML is older, XML-heavy, and unfashionable — and it still runs enterprise identity, because the corporate world standardized on it a decade before OIDC existed and enterprise software moves slowly. If you build anything sold to businesses, you will meet SAML, and understanding it as "the same federated-login idea as OIDC, different machinery" is what makes it approachable.

SAML is older, XML-heavy, and unfashionable — and it still runs enterprise identity. If you build anything sold to businesses you will meet SAML, and understanding it as 'the same federated-login idea as OIDC, different machinery' makes it approachable.

#SAML#Identity#Authentication#Enterprise#Security
Pratik Dhanave · ·6 min read

OpenID Connect: Authentication on OAuth

Everyone kept using OAuth to log users in, and everyone kept doing it slightly wrong, because OAuth was never designed to answer "who is this user?" OpenID Connect is the fix: a thin, standardized authentication layer on top of OAuth that adds one crucial thing — an ID token that securely tells you who the user is. It's what "Sign in with Google" actually runs on.

Everyone kept using OAuth to log users in, and kept doing it slightly wrong, because OAuth was never designed to answer 'who is this user?' OpenID Connect is the fix: a thin authentication layer on OAuth that adds an ID token. It's what 'Sign in with…' runs on.

#OpenID Connect#Identity#Authentication#Security
Pratik Dhanave · ·7 min read

Tokens: Access, Refresh, and JWTs

Tokens are the currency of modern identity — they carry proof of authorization and identity across every request. But "token" hides real distinctions: access versus refresh versus ID tokens do different jobs, and a JWT you can read but must validate correctly is a razor that cuts both ways. Most identity vulnerabilities live in how tokens are issued, stored, and checked.

Tokens are the currency of modern identity — access, refresh, and ID tokens do different jobs, and a JWT you can read but must validate correctly is a razor that cuts both ways. Most identity vulnerabilities live in how tokens are issued, stored, and checked.

#Identity#Security#JWT#Authentication
Pratik Dhanave · ·6 min read

The OAuth Flows

OAuth isn't one procedure — it's a family of flows for different kinds of clients, and picking the wrong one is a security bug, not a style choice. The good news is that modern guidance has collapsed the confusion: for almost every case today, the answer is the authorization code flow with PKCE, and knowing why the alternatives were deprecated is knowing OAuth security.

OAuth isn't one procedure — it's a family of flows for different clients, and picking the wrong one is a security bug. Modern guidance collapsed the confusion: for almost every case, the answer is the authorization code flow with PKCE.

#OAuth#Identity#Security#Authorization#Authentication
Pratik Dhanave · ·5 min read

OAuth 2.0: Delegated Authorization

OAuth solved a specific, once-terrible problem: how does an app access your data on another service without you handing over your password? Its answer — a scoped, revocable token granted through a trusted intermediary — is elegant, but only if you remember what OAuth actually is. It's authorization, not login, and everything about it makes sense once you hold that firmly.

OAuth solved a once-terrible problem: how does an app access your data on another service without your password? Its answer — a scoped, revocable token through a trusted intermediary — is elegant, but only if you remember it's authorization, not login.

#OAuth#Identity#Security#Authorization#Authentication
Pratik Dhanave · ·6 min read

Authentication vs Authorization

Half of all identity confusion — and a surprising share of security bugs — comes from blurring two words that sound alike and mean opposite things. Authentication asks "who are you?"; authorization asks "what are you allowed to do?" Every protocol in this series exists to answer one or the other, and mixing them up is how you build systems that are both insecure and broken.

Half of all identity confusion — and a surprising share of security bugs — comes from blurring two words: authentication asks 'who are you?', authorization asks 'what are you allowed to do?' Every protocol in this series answers one or the other.

#Identity#Security#Authentication#Web Development
Pratik Dhanave · ·7 min read

Hashing, MACs, and Storing Passwords

"Just hash the password" is advice that's simultaneously right and dangerous — right that you never store plaintext, dangerous because a fast cryptographic hash like SHA-256 is exactly the wrong tool for passwords. Hashing, message authentication, and password storage are three different jobs that all involve hashing, and confusing them is a classic source of real breaches.

'Just hash the password' is simultaneously right and dangerous — right that you never store plaintext, dangerous because a fast hash like SHA-256 is the wrong tool for passwords. Hashing, MACs, and password storage are three different jobs that all involve hashing.

#Cryptography#Security Engineering#Backend Engineering#Authentication#Computer Science
Pratik Dhanave · ·14 min read

Authentication: Proving Who Is Calling Your API

The second post in the API Security series — a practical tour of API keys, session cookies, bearer tokens, OAuth 2.0, OIDC and JWTs, plus how to verify a token correctly and where authentication quietly breaks.

Proving who is calling: API keys vs sessions vs bearer tokens, OAuth 2.0 grant types and OIDC, and JWT validation done right — the alg:none / algorithm-confusion pitfalls, verifying signature/exp/aud/iss, and access vs refresh token rotation.

#API Security#Authentication#OAuth#JWT#Security#APIs

All posts on this site are written by Pratik Dhanave, an Agentic AI Architect with 7+ years building production distributed systems, multi-agent AI platforms, and cloud-native infrastructure. About the author → Each article includes working code, architecture diagrams, and references to the specific frameworks and standards discussed. Browse all posts or explore related topics using the tag cloud above.