Install
Please confirm you are human
This browser or connection looks automated. Press and continuously hold the control for 3 seconds to enable Google-hosted web results and, when separately allowed, AI-assisted answers.
A successful check enables 100 search requests. Interactive access does not authorize scraping, systematic collection, or reuse of search output.
News
Expo + Supabase GitHub Auth Broke 3 Times — Here's the Fix
9+ hour, 56+ min ago (891+ words) TL;DR: GitHub login in my Expo app broke three separate times. A deep link that went nowhere. A PKCE flow I wired backwards. A redirect URL with a typo. Each fix is copy-pasteable below. Total auth code is under…...
Rotating refresh tokens: Why critical in authorization
4+ day, 15+ hour ago (623+ words) Every app that keeps you logged in for more than an hour has quietly made a trade. A long-lived credential is convenient and dangerous; a short-lived one is safe and annoying. The standard way out of that bind is a…...
Build a Password + Google OAuth MVP with NestJS and brkpt-auth (in 15 Minutes)
4+ day, 18+ hour ago (429+ words) The last post in this series looked at why hand-rolled NestJS auth tends to accumulate glue code as real requirements pile up, and introduced brkpt-auth: full source code installed into your project, structured around interfaces (ports) you implement (adapters), so…...
Node.js Account Shutdown: Token Revocation and Eventual Deletion in 3 Steps
5+ day, 6+ hour ago (361+ words) In a customer-support system, the hard part of account shutdown is deciding what must stop now and what can wait. A stolen refresh token is an immediate abuse problem; an account deletion request is a data-lifecycle problem with a different…...
OAuthJwks
5+ day, 14+ hour ago (43+ words) OpenRouter Fetch the complete documentation index at: /docs/llms.txt Use this file to discover all available pages before exploring further. Field Type Required Description keys List[components.Key]:heavy_check_mark: N/A Assistant Responses are generated using AI and may contain…...
MCP's new spec turns a planted prompt into a stolen credential
1+ week, 11+ hour ago (732+ words) CleoPtolemy made with Midjourney For platform teams, this is an exercise in scaling. It's also a pivot in security. Here's what has changed, and what you need to do about it. MCP is now stateless at the protocol level. The…...
OAuth 2.1 for MCP servers, done properly
1+ week, 14+ hour ago (650+ words) Authorization is formally optional in MCP. That wording misleads people. It means you may run an unprotected server; it does not mean you get to half-implement a protected one. The moment you do protect an HTTP transport, the spec fills…...
Google OAuth 2.0 for Developers: Implementation, Security Best Practices, and Troubleshooting
1+ week, 1+ day ago (1210+ words) Google OAuth 2.0 often looks simple at first: create credentials, redirect a user to Google, receive... Tagged with oauth....
ANAF SPV E-Invoicing from Java/Spring Boot: OAuth2, JWT Access Tokens, and a Refresh Window That Never Rests
1+ week, 2+ day ago (187+ words) AnafAuthController exposes GET /v1/auth/anaf/authorize: hit it from a browser (Accept: text/html) and it 302-redirects you to ANAF; call it from an API client and it returns the URL as JSON. The URL is assembled in AnafTokenManager.getAuthorizationUrl…...
Immediate Access Shutdown for Profile Updates and Global Session Revocation (3 Rules)
1+ week, 3+ day ago (773+ words) A healthtech signup flow can pass its captcha and still leave a dangerous gap: an account is banned in the profile database while an already-issued session keeps working. That is an access-control incident waiting for a clock to run out....