# JWT Published articles for JWT. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Implementing defense-in-depth authorization for MCP tools on Amazon Quick DevFeed: [Implementing defense-in-depth authorization for MCP tools on Amazon Quick]() Original publisher: [Read original article]() Author: Anneline Sibanda Published: 2026-09-17T15:30:17Z Content type: tutorial Language: en Sources: [Artificial Intelligence]() Topics: [Model Context Protocol (MCP)](), [Authorization](), [Amazon Bedrock AgentCore](), [Entra ID](), [gateway](), [JSON Web Tokens](), [OpenID connect (OIDC)](), [MFA](), [audit trail]() Tags: [access-control](), [advanced-300](), [amazon-bedrock-agentcore](), [amazon-quick-suite](), [audit-trail](), [defense-in-depth](), [entra-id](), [gateway](), [jwt](), [mfa](), [model-context-protocol-mcp](), [oidc](), [technical-how-to]() ### AI overview This walkthrough explains a defense-in-depth authorization pattern for MCP tools connected to Amazon Quick. It uses Microsoft Entra ID and OIDC JWT claims with an Amazon Bedrock AgentCore Gateway interceptor to apply per-user, per-tool, and parameter-level access controls, including role-based and attribute-based checks and an audit trail. ### Source excerpt Learn how to enforce defense-in-depth authorization for Model Context Protocol (MCP) tools on Amazon Quick. This walkthrough wires Microsoft Entra ID group and claims-based JWTs through an Amazon Bedrock AgentCore Gateway interceptor to apply per-user, per-tool role-based and attribute-based access control, with a server-side check and an immutable audit trail. ## Why You're Getting 429s in Production Using Auth0 and How to Stop Them DevFeed: [Why You're Getting 429s in Production Using Auth0 and How to Stop Them]() Original publisher: [Read original article]() Author: Carla Urrea Stabile Published: 2026-09-10T00:00:00Z Content type: tutorial Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [API](), [Authorization](), [Caching](), [JSON Web Tokens](), [Latency]() Tags: [apis](), [auth0](), [authorization](), [caching](), [errors](), [how-to](), [jwt](), [latency](), [production](), [token]() ### AI overview This tutorial explains why Auth0 API requests return 429 rate-limit errors in production. It identifies per-request Management API calls and repeatedly fetching machine-to-machine tokens as common causes, and recommends putting suitable authorization data in JWT claims, caching reusable tokens, logging rate-limit headers, and using short-lived tokens or live checks when changes must take effect immediately. ### Source excerpt Getting Auth0 429 status code errors in production? They almost always trace back to APIs rate limit. Here are the two causes and how to fix them. ## OIDC is a standard, identity providers are not DevFeed: [OIDC is a standard, identity providers are not]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-09T16:09:50Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [OpenID connect (OIDC)](), [interoperability](), [OAuth](), [JSON Web Tokens](), [Authentication]() Tags: [compatibility](), [interoperability](), [jwt](), [oauth](), [oidc](), [providers]() ### AI overview This article explains why generic OpenID Connect integrations often require provider-specific compatibility settings. It discusses differences in token-endpoint client authentication, including client secret basic, client secret POST, and private key JWT. ### Source excerpt Generic OIDC connections meet identity providers that read the same spec differently. Here are the per-connection compatibility settings we added, and why. ## Inside the ID-JAG: How enterprise-managed authorization actually works DevFeed: [Inside the ID-JAG: How enterprise-managed authorization actually works]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [Model Context Protocol](), [JSON Web Tokens](), [OAuth]() Tags: [authorization](), [enterprise](), [jwt](), [mcp](), [mcp-server](), [oauth]() ### AI overview This tutorial explains how the Enterprise-Managed Authorization extension to MCP uses ID-JAGs--short-lived, signed JWT authorization grants--to let an identity provider authorize a client to access an MCP resource server. The authorization server exchanges the ID-JAG for an access token, replacing repeated user consent screens with centrally managed enterprise authorization. The article notes that the ID-JAG draft remains an active IETF document even though the MCP extension is marked Stable. ### Source excerpt The consent screen is no longer where access gets decided. Here is what replaced it, and what your MCP server now has to validate. ## How to Implement OIDC Back-Channel Logout DevFeed: [How to Implement OIDC Back-Channel Logout]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [OpenID connect (OIDC)](), [Single sign-on (SSO)](), [JSON Web Tokens](), [App](), [Server]() Tags: [how-to](), [implement](), [jwt](), [oidc](), [server](), [sso](), [token](), [tokens]() ### AI overview This tutorial explains OIDC back-channel logout, including provider discovery, endpoint registration, form-encoded logout requests, and logout-token validation. It also describes how session-specific and user-wide logout work and notes limitations acknowledged by the specification. ### Source excerpt It is the one standard that can end a session your app already issued, it has been final since 2022, and almost nobody implements it. Here is the whole mechanism, the validation your endpoint owes, and the two limitations the spec admits to itself. ## Five Reasons Why Your Auth0 Permissions Are Not in your Access Token DevFeed: [Five Reasons Why Your Auth0 Permissions Are Not in your Access Token]() Original publisher: [Read original article]() Author: Carla Urrea Stabile Published: 2026-09-03T00:00:00Z Content type: tutorial Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [Authorization](), [JSON Web Tokens](), [AWS Identity and Access Management (IAM)]() Tags: [auth0](), [authorization](), [how-to](), [jwt](), [tokens]() ### AI overview A tutorial explaining five common reasons Auth0 RBAC permissions may be missing from an access token, including an omitted audience parameter, disabled permission settings, and incomplete role assignments. ### Source excerpt Decoding your Auth0 JWT and seeing an empty permissions array? Here are 5 common reasons your Auth0 RBAC permissions are missing and how to fix them fast. ## OpenID Connect Authentication for MySQL, Now Fully Open Source DevFeed: [OpenID Connect Authentication for MySQL, Now Fully Open Source]() Original publisher: [Read original article]() Author: Michał Jankowski Published: 2026-09-02T08:56:26Z Content type: article Language: en Sources: [Blog - Percona]() Topics: [MySQL](), [OpenID connect (OIDC)](), [Authentication](), [JSON Web Tokens](), [OAuth](), [Open Source]() Tags: [authentication](), [jwks](), [jwt](), [mysql](), [oauth](), [oauth-2-0](), [oidc](), [open-source](), [openid-connect](), [percona](), [percona-server-for-mysql](), [percona-software](), [security]() ### AI overview Percona Server for MySQL includes an open-source OpenID Connect authentication plugin for specified 8.4 and 9.7 releases. The article explains how it authenticates users through standards-compliant identity providers and describes capabilities beyond the MySQL Enterprise plugin, including JWKS signing-key synchronization, group-to-role mapping, and proxy-user support. ### Source excerpt Percona Server for MySQL now ships with a fully open source OpenID Connect (OIDC) authentication plugin, available starting with Percona Server for MySQL 8.4.11-11 and 9.7.2-2 (not yet released as of this writing). It allows a MySQL account to authenticate against any standards-compliant Identity Provider (IdP) instead of relying on a locally stored password, closing ... Continued The post OpenID Connect Authentication for MySQL, Now Fully Open Source appeared first on Percona. ## Your app is the other half of agent SSO DevFeed: [Your app is the other half of agent SSO]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-31T20:22:53Z Content type: opinion Language: en Sources: [WorkOS Blog]() Topics: [Single sign-on (SSO)](), [Authorization](), [JSON Web Tokens](), [OAuth 2.0](), [computer-use]() Tags: [ai-agents](), [app](), [authorization](), [jwt](), [oauth-2-0](), [security](), [sso]() ### AI overview This commentary explains that Okta's Agent SSO and the Cross App Access standard broker connections between AI agents and enterprise applications, but the connected application remains responsible for validating the grant and issuing its own access token. It describes the resource-side roles and the underlying OAuth and JWT-based standards. ### Source excerpt Okta's Agent SSO went GA on the Cross App Access standard. The IdP brokers the connection, but your app still has to validate the grant and issue the token. ## Keycloak 26.7.3 released DevFeed: [Keycloak 26.7.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-31T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [JSON Web Tokens](), [LDAP](), [reCAPTCHA]() Tags: [2026](), [cve](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [microsoft](), [oidc](), [openid-connect](), [recaptcha](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.3 was released on August 31, 2026. The release includes security fixes addressing LDAP certificate verification, signed-JWT assertion policies, authorization controls, information disclosure, token exchange restrictions, OIDC response-parameter injection, and related issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #50785 CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap #50997 [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc #50998 [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users organizations #51001 [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2 admin/fine-grained-permissions #51002 [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints admin/rbac #51003 [CVE-2026-16089] Authorization codes can be retargeted to another client session oidc #51005 [CVE-2026-16104] Authenticator config surfaces expose raw reCAPTCHA secrets admin/fine-grained-permissions #51112 [CVE-2026-16106] Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles admin/fine-grained-permissions #51142 [CVE-2026-17059] Information disclosure: GET /roles/{role}/users returns user PII without the per-user view filter admin/fine-grained-permissions #51279 [CVE-2026-18218] Client not-before revocation is ignored when realm not-before is older but nonzero oidc #51282 [CVE-2026-18215] Microsoft external access-token exchange bypasses configured tenant token-exchange #51283 [CVE-2026-18201] Generic identity-provider creation can bind brokers to organizations without manage-organizations organizations #51286 [CVE-2026-18209] Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check (commit 18832bca) inspects only the query string, not the URL fragment oidc #51287 [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction token-exchange #5137 ## 【kube-apiserver】Authentication：SA、Bearer、OIDC 边界 DevFeed: [【kube-apiserver】Authentication：SA、Bearer、OIDC 边界]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Authentication](), [Kubernetes](), [OpenID connect (OIDC)](), [JSON Web Tokens](), [authz]() Tags: [api](), [apiserver](), [authentication](), [authorization](), [bearer-token](), [distributed](), [jwt](), [k8s](), [kubernetes](), [oidc](), [serviceaccount](), [v1-30-3]() ### AI overview This Chinese-language tutorial explains the kube-apiserver authentication chain in Kubernetes v1.30.3. It distinguishes X.509 certificates, ServiceAccount tokens, static and bootstrap tokens, OIDC JWTs, webhook authentication, and anonymous requests, and separates authentication failures such as 401 from storage-layer failures such as 503 or 504. ### Source excerpt 钉 K8s v1.30.3 的认证链：X509、SA token（bound token）、Bearer、OIDC、Webhook token、匿名用户；ServiceAccount bound token 与 TokenRequest 语义；apiserver 认证 flags 边界；401 与存储层故障的分列；AuthZ 路径见第 11 篇。 ## Enterprise-managed auth is GA and your MCP server needs a new grant type DevFeed: [Enterprise-managed auth is GA and your MCP server needs a new grant type]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-26T14:14:11Z Content type: release Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol](), [anthropic](), [Authorization](), [JSON Web Tokens](), [Claude](), [OAuth](), [vs-code]() Tags: [anthropic](), [authorization](), [claude](), [claude-code](), [jwt](), [mcp](), [mcp-server](), [oauth](), [vs-code]() ### AI overview Anthropic's enterprise-managed authentication for MCP connectors is generally available. MCP server authorization servers must support JWT bearer grants, omit dynamic client registration, and establish trust for each tenant's issuer. The article also describes adoption across Claude, VS Code, and enterprise identity providers. ### Source excerpt Anthropic's enterprise-managed auth for MCP connectors is now GA. What your authorization server has to support: JWT bearer, no DCR, per-tenant issuer trust. ## Add Cross App Access to Your OIDC Resource Application DevFeed: [Add Cross App Access to Your OIDC Resource Application]() Original publisher: [Read original article]() Author: Sohail Pathan Published: 2026-08-24T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OpenID connect (OIDC)](), [API](), [Authorization](), [JSON Web Tokens](), [Single sign-on (SSO)](), [OAuth 2.0]() Tags: [api](), [authorization](), [cross-app-access](), [jwt](), [oauth-2-0](), [oidc](), [okta](), [scopes](), [sso](), [token](), [xaa]() ### AI overview This guide explains how OIDC-federated applications can support Cross App Access (XAA) for API access on behalf of users. It covers validating and redeeming the ID-JAG, resolving users from claims, issuing access tokens, updating authorization server metadata, and testing the end-to-end flow. ### Source excerpt If you currently federate enterprise customers using OpenID Connect (OIDC) and want to allow applications to access your API on behalf of those users, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your authorization server already trusts the customer's IdP for single sign-on (SSO), and XAA reuses that same trust for API access. This guide details what you need to support, how to validate the grant, and how to resolve the user at your resource authorization server. Table of Contents How XAA in OIDC works Analyzing the ID-JAG claims XAA implementation checklist for OIDC-federated applications Mapping user identity from iss and sub Validating the ID-JAG and resolving the user Issuing the access token Updating authorization server metadata Making cross-application requests from your OIDC app securely Configure your XAA OIDC Resource app in Okta Create the OIDC requesting app for testing Create the OIDC resource app in Okta Register and configure the AI Agent in Okta Verify your Okta XAA setup on xaa.dev Configure OIDC SSO Verify the refresh token exchange for an ID-JAG token Redeem the ID-JAG for an access token at the resource authorization server Call the resource API with the access token Prove the XAA connection end-to-end Takeaways for implementors who also have SAML apps Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the customer's Identity Provider (IdP) for your authorization server. Your resource server accepts the token, identifies the user, and issues your own access token, all while leaving the customer's existing OIDC integration untouched. The sequence diagram shown below describes the OIDC XAA flow. Notice that the OIDC SSO flow stays the ## Add Cross App Access to Your OIDC Requesting Application DevFeed: [Add Cross App Access to Your OIDC Requesting Application]() Original publisher: [Read original article]() Author: Sohail Pathan Published: 2026-08-21T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OpenID connect (OIDC)](), [OAuth](), [OAuth 2.0](), [JSON Web Tokens](), [API](), [Authorization](), [AI Agent]() Tags: [agent](), [api](), [authorization](), [callback](), [claude](), [cross-app-access](), [identity](), [jwt](), [oauth](), [oauth-2-0](), [oidc](), [openid-connect](), [sso](), [third-party-applications](), [token](), [xaa]() ### AI overview This guide explains how an OIDC-federated application can use Cross App Access (XAA) to request resources from a third-party application. It describes exchanging a refresh token for an Identity Assertion Authorization Grant, exchanging that short-lived JWT for an OAuth access token, and using the access token for the resource API request. ### Source excerpt If you currently federate enterprise customers using OpenID Connect (OIDC) and want to connect with third-party applications, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your app already holds an ID token after sign-in, but it's the refresh token from that same sign-in that you exchange to reach a third-party app. This guide details what you need to support and how to make resource requests to a third-party app using XAA. Table of Contents How XAA in OIDC works XAA implementation checklist for OIDC-federated applications Request the ID-JAG token Request the access token Call the resource API Handle token expiration Making cross-application requests from your OIDC app securely Configure your XAA OIDC requesting app in Okta Register the requesting app in Okta Register the test resource app in Okta Register your requesting app at xaa.dev Register and configure the AI Agent in Okta Validate the XAA connection end-to-end Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the Identity Provider (IdP) for your app's user. You exchange the ID-JAG token for an access token to the resource application you're connecting with. The sequence diagram below describes the OIDC XAA flow and how your application fits into it. You'll handle the flow in two parts: where your application requests the ID-JAG from the IdP using the refresh token, and where your app requests the access token from the ID-JAG from the third-party resource app's authorization server. XAA implementation checklist for OIDC-federated applications Follow the guide in this section to support XAA in your OIDC application when your app connects to a third-party resource application. The XAA flow places t ## How to add enterprise SSO to an Express.js API DevFeed: [How to add enterprise SSO to an Express.js API]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-21T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Single sign-on (SSO)](), [Tutorial](), [Express](), [Node.js](), [API](), [JSON Web Tokens](), [OpenID connect (OIDC)](), [Authorization](), [Back end]() Tags: [api](), [authorization](), [how-to](), [js](), [jwt](), [middleware](), [node-js](), [oidc](), [security](), [sso]() ### AI overview A step-by-step tutorial for adding enterprise SSO to an Express.js API with WorkOS. It covers SAML and OIDC login redirects, callback handling, JWT verification on protected routes, and multi-tenant authorization using signed token claims. ### Source excerpt Add enterprise SSO (SAML and OIDC) to an Express.js API with WorkOS. Step-by-step Node.js code for the login redirect, the callback, and JWT verification on protected API routes. ## Okta Cross App Access (XAA / ID-JAG) in Nirmata AIControls: standards-based authorization for AI agents DevFeed: [Okta Cross App Access (XAA / ID-JAG) in Nirmata AIControls: standards-based authorization for AI agents]() Original publisher: [Read original article]() Author: Ritesh Patel Published: 2026-08-19T00:24:40Z Content type: article Language: en Sources: [Nirmata]() Topics: [cross-app-access](), [Authorization](), [okta](), [Artificial Intelligence](), [Model Context Protocol (MCP)](), [Large Language Model](), [JSON Web Tokens](), [OAuth]() Tags: [ai](), [authorization](), [cross-app-access](), [engineering](), [jwt](), [llm](), [mcp](), [mcp-server](), [oauth](), [okta](), [standards]() ### AI overview The article explains how Nirmata AIControls supports Okta Cross App Access and the ID-JAG authorization profile for AI agents. It describes token exchanges performed on behalf of agents, administrator-controlled app-to-app access, policy checks, budgets, and audit records for delegated MCP and LLM calls. ### Source excerpt AIControls now performs the ID-JAG token exchanges on your agents' behalf -- so agents need no protocol code -- and policy-checks, budgets, and attributes every delegated MCP and LLM call to the human it acts for. ID-JAG answers may this agent act for this user? AIControls answers what... The post Okta Cross App Access (XAA / ID-JAG) in Nirmata AIControls: standards-based authorization for AI agents first appeared on Nirmata. ## How to store and refresh session tokens correctly with the WorkOS iOS SDK DevFeed: [How to store and refresh session tokens correctly with the WorkOS iOS SDK]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-18T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [iOS](), [SDK](), [Authentication](), [JSON Web Tokens]() Tags: [apple](), [auth](), [authentication](), [concurrent](), [guide](), [how-to](), [ios](), [jwt](), [native](), [plist](), [rotation](), [sdk](), [storage](), [tokens](), [tutorial]() ### AI overview This tutorial explains how to store and refresh session tokens with the WorkOS iOS SDK. It recommends storing access and refresh tokens in the Keychain, persisting each rotated refresh token, and distinguishing terminal refresh failures from transient network or concurrency-related failures. ### Source excerpt A practical guide to Keychain storage, refresh token rotation, and terminal vs. transient failures on iOS ## \[webapps\] Duplicati 2.2.0.3 - JWT Signing Key Leak DevFeed: [\[webapps\] Duplicati 2.2.0.3 - JWT Signing Key Leak]() Original publisher: [Read original article]() Author: Gabriel Rodrigues Published: 2026-08-17T00:00:00Z Content type: article Language: en Sources: [Exploit-DB.com RSS Feed]() Topics: [JSON Web Tokens](), [Exploit]() Tags: [exploit](), [jwt](), [leak](), [multiple](), [platform](), [signing](), [webapps]() ### AI overview An exploit listing identifies a JWT signing key leak in Duplicati 2.2.0.3 and describes it as a web application exploit for multiple platforms. ### Source excerpt Duplicati 2.2.0.3 - JWT Signing Key Leak ## Security Baked Into the JVM: two Subjects, one call DevFeed: [Security Baked Into the JVM: two Subjects, one call]() Original publisher: [Read original article]() Author: Peter Firmstone Published: 2026-08-09T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Security](), [SPIFFE](), [SPIRE]() Tags: [certificates](), [dirtychai](), [java](), [jgdms](), [jini](), [jvm](), [jwt](), [microservices](), [oidc](), [permission](), [process](), [security](), [spiffe](), [spire](), [technical]() ### AI overview This article examines identity and security in the JVM through DirtyChai. It describes separate process and user identities, including SPIFFE workload credentials delivered through SPIRE and JWT/OIDC-based user identity, and explains how these identities coexist across request dispatch and privilege boundaries. ### Source excerpt The constraint system stops a bad call before it leaves the JVM. The Safe Codebase Audit Pipeline stops bad code before a client ever loads it. What remains is identity: who is calling, and can you verify it? Most frameworks answer with a token check at the door. A filter validates a bearer token, sets a thread-local variable, and hopes that nothing downstream forgets to look at it. DirtyChai answers differently. ## Why We Wrote a New JWT Library for Kotlin Multiplatform DevFeed: [Why We Wrote a New JWT Library for Kotlin Multiplatform]() Original publisher: [Read original article]() Published: 2026-08-07T00:00:00Z Content type: article Language: en Sources: [Touchlab | Enterprise Mobile Innovation & Development]() Topics: [JSON Web Tokens](), [Kotlin Multiplatform](), [Cryptography](), [Authentication](), [Authorization](), [Open Source](), [Library]() Tags: [authentication](), [authorization](), [community](), [cryptography](), [jwt](), [kmp](), [kotlin](), [kotlin-multiplatform](), [libraries](), [library](), [open-source]() ### AI overview The author explains how a security-focused Kotlin Multiplatform banking project led to research into cryptography and JWTs. After finding that JJWT was limited for cross-platform projects, they began developing a new JWT library as a personal open-source learning project. ### Source excerpt Earlier this year, we silently started working on and published a new KMP library. The reason it exists serves as a good lesson on how to start contributing to the open-source community. ## Why stateless JWT logout is not immediate and how to revoke access DevFeed: [Why stateless JWT logout is not immediate and how to revoke access]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-06T01:36:54Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [JSON Web Tokens](), [Security](), [Architecture & Design]() Tags: [jwt](), [public-key](), [rotation](), [security](), [stateless](), [token](), [verification]() ### AI overview The article explains that signed stateless JWTs remain valid until expiration, so logging out or deactivating a user cannot revoke an already-issued token immediately. It compares short-lived access tokens with refresh-token rotation against a server-side denylist as approaches to revocation. ### Source excerpt Stateless JWTs stay valid until they expire, so logout isn't instant. Here's why enterprise SCIM makes that a compliance problem -- and how to really fix it. ## REST API Authentication Methods Clearly Explained DevFeed: [REST API Authentication Methods Clearly Explained]() Original publisher: [Read original article]() Author: Nikki Siapno Published: 2026-08-05T18:25:08Z Content type: tutorial Language: en Sources: [Level Up Coding System Design Newsletter]() Topics: [Authentication](), [REST API](), [API keys](), [Authorization](), [Security]() Tags: [api](), [api-keys](), [authentication](), [authorization](), [jwt](), [private-key](), [rest](), [security]() ### AI overview This tutorial explains REST API authentication methods, including API keys, bearer tokens, JWTs, HMAC secrets, and mutual TLS. It distinguishes authentication from authorization and discusses operational concerns such as credential rotation, revocation, auditing, rate limiting, and responding to leaked credentials. ### Source excerpt 8 API authentication methods every developer should know. ## SecretSpec 0.17: scopes, secrets caching, SOPS, age, and systemd credentials DevFeed: [SecretSpec 0.17: scopes, secrets caching, SOPS, age, and systemd credentials]() Original publisher: [Read original article]() Author: domenkozar Published: 2026-07-27T04:36:14Z Content type: release Language: en Sources: [Announcements - NixOS Discourse]() Topics: [SDKs](), [Authentication](), [GitHub](), [forgejo](), [Caching](), [OpenID connect (OIDC)]() Tags: [announcements](), [authentication](), [caching](), [forgejo](), [github](), [jwt](), [oidc](), [scaleway](), [sdk](), [sdks](), [systemd](), [upgrade]() ### AI overview SecretSpec 0.17 adds scoped secret resolution, caching for slow remote providers, cross-secret validation, JWT/OIDC authentication for Vault and OpenBao, GitHub and Forgejo Actions support, and six new providers. Its SDKs also gain scope support, requiring applications to upgrade the SDK package and bundled native resolver together. ### Source excerpt Hi all, We've released SecretSpec 0.17 with: scopes: consumers can now resolve only the secrets it declares, instead of receiving an entire profile. Secrets caching for slow remote providers, with configurable freshness and explicit invalidation. Cross-secret validation, including "at least one" and "exactly one" credential groups. JWT/OIDC authentication for Vault and OpenBao. A new GitHub and Forgejo Action that resolves, masks, and exposes secrets to later workflow steps. Six new providers: SOPS, age, KeePass KDBX, OpenBao, Scaleway Secret Manager, and systemd credentials. All SecretSpec SDKs have been updated with scope support. This required an FFI change, so applications should upgrade the SDK package and bundled native resolver together. Read the release blog post post or see the GitHub release. Domen Disclaimer: LLMs have been used in all the work delivered 1 post - 1 participant Read full topic ## Enable Your SAML Requesting App for Cross App Access DevFeed: [Enable Your SAML Requesting App for Cross App Access]() Original publisher: [Read original article]() Author: Alisa Duncan Published: 2026-07-17T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OAuth 2.0](), [Authorization](), [JSON Web Tokens](), [OpenID connect (OIDC)](), [API](), [AI Agent]() Tags: [api](), [authorization](), [claude](), [cross-app-access](), [digital-signature](), [identity](), [idp](), [implementation](), [jwt](), [oauth](), [oauth-2-0](), [oidc](), [openid-connect](), [payload](), [saml](), [signing](), [sso](), [xaa]() ### AI overview This guide explains how SAML-federated applications can use Cross App Access (XAA) to connect to third-party applications without migrating to OpenID Connect. It covers exchanging a SAML assertion for an OAuth refresh token, an ID-JAG, and an access token, along with token validation and Okta configuration. ### Source excerpt If you currently federate enterprise customers using Security Assertion Markup Language (SAML) and want to connect with third-party applications without migrating to OpenID Connect (OIDC), this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was originally designed with OIDC in mind. To use it in SAML applications, you must accommodate specific security and uniqueness requirements. This guide details what you need to support and how to make resource requests to a third-party app using XAA. Table of Contents How XAA in SAML works XAA implementation checklist for SAML-federated applications Request the refresh token Request the ID-JAG token Request the access token Handle token expiration Making cross-application requests from your SAML app securely Configure your XAA SAML Requesting App in Okta Register and configure the AI Agent in Okta Test the SAML 2.0 app Validate the XAA connection end-to-end Learn more about Cross App Access, SAML, and OAuth 2.0 How XAA in SAML works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the Identity Provider (IdP) for your app's user. You exchange the ID-JAG token for an access token to the resource application you're connecting with. The sequence diagram shown below describes the SAML XAA flow and how your application fits in. You'll handle the flow in two parts: where your application requests the ID-JAG from the IdP using a refresh token, and where your app requests the access token from the ID-JAG from the third-party resource app's authorization server. XAA implementation checklist for SAML-federated applications Follow the guide in this section to support XAA in your SAML application when your app connects to a third-party resource application. The XAA flow places the burden of token validation onto the IdP and the resource ap ## Build a Secure C# MCP App with Cross App Access (XAA) DevFeed: [Build a Secure C# MCP App with Cross App Access (XAA)]() Original publisher: [Read original article]() Author: Aasawari Sahasrabuddhe Published: 2026-07-16T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [cross-app-access](), [Model Context Protocol (MCP)](), [C#](), [SDKs](), [AI Agent](), [API]() Tags: [ai-agent](), [ai-agents](), [api](), [authorization](), [c-sharp](), [cross-app-access](), [csharp](), [jwt](), [mcp](), [oauth](), [oidc](), [pkce](), [sdk](), [xaa]() ### AI overview This tutorial explains how Cross App Access (XAA) extends user identity and enterprise policy to downstream applications, MCP servers, APIs, and agent tools. It demonstrates the XAA token-exchange flow and shows how to implement a secure MCP client in C# with an MCP SDK. ### Source excerpt A few years ago, getting a user signed in to an application or multiple applications with Single Sign-On (SSO) was enough; OpenID Connect (OIDC) handled the login, JWTs carried the claims, and Proof Key for Code Exchange (PKCE) made it secure. Today, with evolving AI, agents act on behalf of users and seek multiple accesses across different resources to execute a task. And that is when you'll hit the gap. The user has an identity, but the downstream service--like a Model Context Protocol (MCP) server, an API, or an agent tool has no way to trust it: the ID Token that proves the user's identity for your app, not for that service. You need a way to take that identity and have it trusted further down the chain, in line with the org's policy, without asking the user to log in again. Cross App Access (XAA) solves exactly that. The user authenticates once. The Identity Provider (IdP) evaluates the enterprise policy and issues a signed Identity Assertion. The downstream service exchanges that assertion for a scoped Bearer token. In this post, we'll explore how Cross App Access (XAA) closes the trust gap, test the flow using an XAA playground, and implement a secure MCP client in just a few lines of C# using our dedicated SDK. Table of Contents What is Cross App Access (XAA)? Implementing XAA with the C# MCP SDK Building the OIDC flow Automate XAA token exchange with C# SDK Connect the MCP client to the server Testing your C# MCP app with xaa.dev Run your C# MCP app with xaa.dev Learn More About Secure AI Agent Development with C# and MCP What is Cross App Access (XAA)? Before we start implementing and building the application, it is important to understand the mechanics of Cross App Access (XAA). At its core, XAA is an open standard that securely enables AI agents to act on behalf of a user and communicate with downstream applications without requiring constant, manual user consent. While the flow is sophisticated, it relies on two standard interactions: RFC 8693 (Token Exc [Next page]()