# OAuth Published articles for OAuth. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face DevFeed: [Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face]() Original publisher: [Read original article]() Author: Tom Hegel Published: 2026-09-16T10:00:34Z Content type: article Language: en Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.]() Topics: [Threat Research](), [Incident response](), [hugging face](), [OpenAI](), [ChatGPT](), [spaces](), [Flask](), [OAuth](), [HTTP]() Tags: [agentic-ai](), [agents](), [chatgpt](), [flask](), [http](), [hugging-face](), [incident-response](), [oauth](), [openai](), [research](), [spaces](), [token]() ### AI overview SentinelLABS traces activity associated with two Hugging Face accounts, 0Time and Nyx9, that appears to extend OpenAI's published chronology. The report describes relay-code commits, a workbook containing unexecuted-looking external probes, and a Flask-wrapped tool that could potentially provision ChatGPT identities or OAuth credentials if deployed and invoked. ### Source excerpt Two Hugging Face accounts reveal that OpenAI's agents staged relay code, internal probes and ChatGPT account registration beyond the published timeline. ## A Threat Hunter's Guide to Detecting Malicious Activity in GitHub Audit Logs DevFeed: [A Threat Hunter's Guide to Detecting Malicious Activity in GitHub Audit Logs]() Original publisher: [Read original article]() Author: Julie Agnes Sparks, Juvenal Araujo Published: 2026-09-16T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [GitHub](), [Threat Hunting & Intel](), [Security](), [Logging](), [Authentication](), [personal access token]() Tags: [authentication](), [github](), [logging](), [oauth](), [personal-access-token](), [secrets](), [security](), [security-research]() ### AI overview This article examines threats targeting GitHub organizations, including compromised accounts, personal access tokens, OAuth tokens, leaked secrets, phishing, and malicious extensions or OAuth apps. It describes GitHub audit-log queries and behaviors that can help detect account compromise, reconnaissance, and source-code exfiltration. ### Source excerpt In this post, we walk through different threats to GitHub and how to detect them. ## How to study for the MCPA security and governance domain DevFeed: [How to study for the MCPA security and governance domain]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-16T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol](), [Security](), [Authorization](), [OAuth]() Tags: [agent](), [agentic](), [audit](), [authorization](), [model-context-protocol](), [oauth](), [security]() ### AI overview A study guide for the security and governance domain of the Model Context Protocol Associate exam. It explains trust boundaries, token audience validation, token handling between MCP servers and upstream APIs, and the distinction between consent and authorization. ### Source excerpt Security and governance is 24% of the new Model Context Protocol Associate exam. Here is what each competency actually covers in the 2026-07-28 spec, and the distinctions candidates get wrong. ## MCP authorization: governing tool calls beyond OAuth DevFeed: [MCP authorization: governing tool calls beyond OAuth]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T15:04:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol](), [Authorization](), [MCP OAuth](), [MCP Server](), [OAuth]() Tags: [authorization](), [mcp](), [mcp-server](), [oauth](), [permissions](), [policy](), [scope](), [scopes]() ### AI overview This guide explains why OAuth scopes alone cannot govern the content and destination of MCP tool calls. It presents server- or gateway-side policy enforcement before execution, including request-content inspection, approval handling, and testing for data leakage. ### Source excerpt Secure MCP tool calls beyond OAuth scopes. Learn where to enforce tool permissions, check request content, and test for data leakage with Airlock. ## Laravel MCP 1.0 Is Released DevFeed: [Laravel MCP 1.0 Is Released]() Original publisher: [Read original article]() Author: Eric L. Barnes Published: 2026-09-15T14:27:51Z Content type: release Language: en Sources: [Laravel]() Topics: [Laravel](), [Model Context Protocol (MCP)](), [OAuth](), [pkce](), [Caching](), [servers]() Tags: [caching](), [context-window](), [laravel](), [mcp](), [news](), [oauth](), [pkce](), [servers]() ### AI overview Laravel MCP 1.0 is the first stable release of Laravel's package for building Model Context Protocol servers. It adds protocol revision 2026-07-28 support, searchable tool catalogs, cache hints, stateless request handling, OAuth changes requiring PKCE, and Client ID Metadata Documents. ### Source excerpt Laravel MCP 1.0 ships protocol revision 2026-07-28, stateless servers, searchable tool catalogs, cache hints, and reworked OAuth with required PKCE. The post Laravel MCP 1.0 Is Released appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox. ## AI SDK harness layer now supports native subscription authentication DevFeed: [AI SDK harness layer now supports native subscription authentication]() Original publisher: [Read original article]() Author: Felix Arntz Published: 2026-09-14T21:28:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [vercel ai sdk](), [Authentication](), [OAuth](), [codex](), [Claude Code]() Tags: [ai](), [authentication](), [claude-code](), [codex](), [coding-agents](), [copilot](), [cursor](), [gateway](), [oauth](), [opencode](), [sdk]() ### AI overview The AI SDK harness layer now supports authenticating supported coding-agent harnesses through their native subscriptions. It uses explicit provider credentials when available, otherwise falls back to a host-native subscription without requiring code or configuration changes. ### Source excerpt The AI SDK harness layer now supports authenticating harnesses through their native subscriptions, where the underlying harness supports them. The harness layer runs different coding agents through the same HarnessAgent interface, so you can switch agents without changing your application code. No code changes or new settings are required. The direct authentication mode uses explicit provider environment credentials when they are present, and otherwise a native subscription found on the host. The default auto mode does the same when no AI Gateway credentials are set. The ai-gateway mode never reads native subscriptions. Native subscription credentials stay on the host. Just like with API keys, credentials are resolved at the host boundary. OAuth access tokens are refreshed there as needed. Where the sandbox supports it, the harness receives placeholder credentials and the real token is injected into outbound requests on the host. Native subscriptions work across harness adapters wherever the harness itself supports subscription login. These include Claude Code, Cline, Codex, Cursor, fx, GitHub Copilot, Grok Build, OpenCode, and Pi. Read the harness documentation to learn more. Read more ## Manage end-user OAuth consent for AI agents with Amazon Bedrock AgentCore DevFeed: [Manage end-user OAuth consent for AI agents with Amazon Bedrock AgentCore]() Original publisher: [Read original article]() Author: Swara Gandhi Published: 2026-09-14T20:35:45Z Content type: tutorial Language: en Sources: [Artificial Intelligence]() Topics: [Amazon Bedrock AgentCore](), [OAuth](), [Amazon Web Services](), [AWS CloudTrail](), [GitHub](), [Slack](), [Model Context Protocol](), [ide]() Tags: [amazon-bedrock](), [amazon-bedrock-agentcore](), [announcements](), [aws](), [aws-cloudtrail](), [claude-code](), [cursor](), [github](), [intermediate-200](), [kiro](), [model-context-protocol](), [oauth](), [slack](), [visual-studio-code]() ### AI overview This tutorial explains how Amazon Bedrock AgentCore Identity's Consent portal manages end-user OAuth consent and session binding for AI agents. It covers configuring GitHub and Slack targets through an AgentCore Gateway, storing user tokens, supporting IDE and MCP clients, and reviewing activity in AWS CloudTrail. ### Source excerpt Amazon Bedrock AgentCore Identity now offers a Consent portal, a managed web experience and session binding endpoint for AgentCore Gateway. This post walks through provisioning a portal, configuring GitHub and Slack 3LO targets, and the end-user consent flow, and shows how to review activity in AWS CloudTrail. ## How to Connect to HMRC's Making Tax Digital API: A Beginner's Guide DevFeed: [How to Connect to HMRC's Making Tax Digital API: A Beginner's Guide]() Original publisher: [Read original article]() Author: Solomon Amos Published: 2026-09-11T22:10:33Z Content type: tutorial Language: en Sources: [freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More]() Topics: [API](), [Security, Privacy and Abuse Prevention]() Tags: [api](), [apis](), [code](), [guide](), [hmrc](), [hmrc-tax-filing](), [hmrc-tax-returns](), [how-to](), [integration](), [mtd](), [node](), [oauth](), [tax](), [tax-return](), [typescript]() ### AI overview A beginner-friendly guide to connecting software to HMRC's Making Tax Digital API. It explains the MTD context, sandbox setup, OAuth 2.0 authentication, fraud prevention headers, and authenticated API calls using Node and TypeScript. ### Source excerpt If you write software for anyone who pays UK tax, sooner or later you'll need to talk to HMRC. Making Tax Digital (MTD) for Income Tax went live on 6 April 2026, and it's already mandatory for self-em ## Introducing automatic remediation policies with Cloudflare CASB DevFeed: [Introducing automatic remediation policies with Cloudflare CASB]() Original publisher: [Read original article]() Author: Abe Carryl Published: 2026-09-11T13:00:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Software as a service](), [Cloudflare One](), [Orchestration](), [Authorization]() Tags: [automation](), [casb](), [cloudflare](), [cloudflare-one](), [event-driven](), [oauth](), [orchestration](), [policy](), [reactive](), [saas](), [security](), [security-operations-center](), [zero-trust]() ### AI overview Cloudflare introduces CASB policies that automatically remediate SaaS security findings, including revoking risky file shares and sending webhooks after a finding is detected. ### Source excerpt Cloudflare CASB policies introduce a native automation engine built directly on the Cloudflare developer platform to remediate SaaS risks automatically. Security teams can now design event-driven logic to revoke risky file shares and send webhooks without manual intervention. ## Adding Google Login to a React App with Auth0 DevFeed: [Adding Google Login to a React App with Auth0]() Original publisher: [Read original article]() Author: Carla Urrea Stabile Published: 2026-09-11T00:00:00Z Content type: tutorial Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [React](), [SDK](), [OAuth](), [OpenID connect (OIDC)](), [Vite](), [web applications](), [Node.js]() Tags: [auth0](), [authentication](), [google](), [node-js](), [oauth](), [oidc](), [react](), [sdk](), [tutorial](), [vite](), [web-applications]() ### AI overview A step-by-step tutorial for adding Google login to a Vite-based React application with Auth0. It covers installing the Auth0 React SDK, creating and configuring an Auth0 application, setting callback, logout, and web-origin URLs, and preparing credentials for production Google authentication. ### Source excerpt Add Google login to a React app with Auth0. A step-by-step tutorial from installing the Auth0 React SDK to configuring your own production Google credentials. ## ClickHouse is a launch partner for the Data agent in ChatGPT Work DevFeed: [ClickHouse is a launch partner for the Data agent in ChatGPT Work]() Original publisher: [Read original article]() Author: Aditya Chidurala; Teresa Blanco Published: 2026-09-10T15:13:26Z Content type: article Language: en Sources: [ClickHouse Blog]() Topics: [AI Chat](), [dashboards](), [AI Bots]() Tags: [agent](), [agent-skills](), [analytics](), [chatgpt](), [clickhouse](), [codex](), [dashboards](), [mcp](), [mcp-server](), [oauth]() ### AI overview ClickHouse announces a ChatGPT Work plugin that connects ClickHouse Cloud through OAuth for natural-language data exploration, reports, and interactive dashboards. ### Source excerpt ClickHouse joins the Data agent in ChatGPT Work, connecting ClickHouse Cloud to natural-language queries, reports, and interactive dashboards. ## Researchers found that 1 in 5 MCP access policies came back broken or missing DevFeed: [Researchers found that 1 in 5 MCP access policies came back broken or missing]() Original publisher: [Read original article]() Author: Shawn Petty Published: 2026-09-10T15:00:00Z Content type: opinion Language: en Sources: [The New Stack]() Topics: [Model Context Protocol](), [Authorization](), [API keys](), [GitHub]() Tags: [ai](), [contributed-cloudbolt](), [github](), [mcp](), [model-context-protocol-mcp](), [oauth](), [security](), [vibe-coding]() ### AI overview The article argues that MCP deployments need stronger authorization and narrower credentials. It highlights prompt-injection risks in tool descriptions, broad default scopes, and limited OAuth use among MCP servers. ### Source excerpt Bob from finance built a scheduling tool last month. He described it to an AI assistant on a Sunday afternoon, The post Researchers found that 1 in 5 MCP access policies came back broken or missing appeared first on The New Stack. ## Claimable Neon: Provisioned by agents, claimed by humans DevFeed: [Claimable Neon: Provisioned by agents, claimed by humans]() Original publisher: [Read original article]() Author: Andre Landgraf Published: 2026-09-10T12:00:00Z Content type: release Language: en Sources: [Blog -- Neon Docs]() Topics: [AI-assisted coding](), [AI Bots]() Tags: [agents](), [api](), [auth](), [backend](), [community](), [database](), [oauth](), [postgres](), [product](), [sql]() ### AI overview Claimable Neon lets agents anonymously provision a temporary Neon project, continue building with scoped credentials, and generate a link for a human to claim the project later. ### Source excerpt Claimable Neon implements the anonymous registration method in auth.md, the open agent registration protocol authored by WorkOS, to give agents a way to provision a temporary Neon project without creating an account or collecting payment details. ## OIDC is a standard, identity providers are not DevFeed: [OIDC is a standard, identity providers are not]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-09T16:09:50Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [OpenID connect (OIDC)](), [interoperability](), [OAuth](), [JSON Web Tokens](), [Authentication]() Tags: [compatibility](), [interoperability](), [jwt](), [oauth](), [oidc](), [providers]() ### AI overview This article explains why generic OpenID Connect integrations often require provider-specific compatibility settings. It discusses differences in token-endpoint client authentication, including client secret basic, client secret POST, and private key JWT. ### Source excerpt Generic OIDC connections meet identity providers that read the same spec differently. Here are the per-connection compatibility settings we added, and why. ## Inside the ID-JAG: How enterprise-managed authorization actually works DevFeed: [Inside the ID-JAG: How enterprise-managed authorization actually works]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [Model Context Protocol](), [JSON Web Tokens](), [OAuth]() Tags: [authorization](), [enterprise](), [jwt](), [mcp](), [mcp-server](), [oauth]() ### AI overview This tutorial explains how the Enterprise-Managed Authorization extension to MCP uses ID-JAGs--short-lived, signed JWT authorization grants--to let an identity provider authorize a client to access an MCP resource server. The authorization server exchanges the ID-JAG for an access token, replacing repeated user consent screens with centrally managed enterprise authorization. The article notes that the ID-JAG draft remains an active IETF document even though the MCP extension is marked Stable. ### Source excerpt The consent screen is no longer where access gets decided. Here is what replaced it, and what your MCP server now has to validate. ## This Week in Spring - September 8th, 2026 DevFeed: [This Week in Spring - September 8th, 2026]() Original publisher: [Read original article]() Author: joshlong Published: 2026-09-08T00:00:00Z Content type: article Language: en Sources: [Spring]() Topics: [Artificial Intelligence](), [Large Language Model](), [Electron](), [App](), [IntelliJ IDEA]() Tags: [ai](), [applications](), [article](), [batch](), [boot](), [cloud](), [event-driven](), [idea](), [intellij](), [intellij-idea](), [java](), [linux](), [llm](), [llms](), [microservices](), [oauth](), [reactive](), [serverless](), [spring](), [spring-ai](), [spring-boot](), [video](), [web-applications](), [windows]() ### AI overview This weekly Spring roundup highlights Spring AI content about running LLMs in the JVM and locally, building a Spring AI starter for agents.md, and improving tool use. It also covers Spring Boot and JavaFX desktop applications, native images, Spring Security OAuth clients, secure application images, external configuration, Spring Cloud AWS, and a Spring Boot Analyzer. ### Source excerpt Bonjour a tout le monde! Welcome to another rip-roarin' installment of This Week in Spring! It's a fabulous and fun day here in Paris, France, as I wait to board the train to Amsterdam for the IntelliJ IDEA conference! It's going to be amazing. We've got another incredible week's roundup to dive into, so let's do it! I feel like some of the best content over the past several months in this weekly roundup has been Craig Walls' Spring AI Recipes section. Fantastic stuff! This latest one looks at running an LLM in-JVM This is a nice article on using vertical slices in Spring Boot on Solodev.sk, by Dominik. Well done! Another amazing installment from Craig Walls, this one looking at running against local LLMs My friend and colleague DaShaun Carter talks about his Spring AI starter for agents.md Craig also has this lovely post on efficient tool use in Spring AI Last week, I did two videos on using Spring Boot, JavaFX, GraalVM native images, and Spring Security (and PKCE) to build native, lightning-fast, dynamic, efficient, reusable desktop applications that run well on Mac, Windows, and Linux, and look amazing, while taking small fractions of the RAM of a similar Electron-based application. Here's the first one, showing how to use Spring Boot and JavaFX together, so that you get the component model, event dispatch subsystem, internationalization, lifecycle management, and, of course, the entire and very rich ecosystem of Spring components and can use them to manage JavaFX components, too. We also look at native image compilation. Here's the second video, which looks at using Spring Security's OAuth client in the context of a desktop application, which can not, by definition, hold a client secret. In last week's installment of A Bootiful Podcast, I was delighted to chat with BellSoft's Catherine Edelveis about trusted and secure images for your Spring Boot applications This is a nice post on managing external configurations with Spring Cloud Config A nice recap of some of ## n8n Patches 18 Security Vulnerabilities in Bi-Weekly Update DevFeed: [n8n Patches 18 Security Vulnerabilities in Bi-Weekly Update]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-06T06:31:02Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [Security](), [Vulnerabilities](), [workflow automation](), [Automation](), [Code](), [Homelab](), [OAuth](), [Regular expression](), [data](), [Git](), [JSON](), [OpenAI]() Tags: [article](), [automation](), [code](), [data](), [external](), [git](), [json](), [n8n](), [n8n-patches-18](), [news](), [oauth](), [openai](), [security](), [self-hosted](), [update](), [vulnerabilities](), [workflow](), [workflow-automation]() ### AI overview n8n's September 2, 2026 bi-weekly security update fixes 18 vulnerabilities: five high-severity and thirteen medium-severity issues. The most serious flaws are two expression-sandbox escapes that can enable arbitrary code execution on self-hosted servers. Other high-severity fixes address denial-of-service, ReDoS, and an OpenAI model-search domain-restriction bypass. ### Source excerpt Read this article in French: n8n corrige 18 failles de sécurité dans sa mise à jour bi-hebdomadaire n8n is one of the most widely deployed self-hosted workflow automation platforms, often described as the fair-code alternative to Zapier and Make. People use it to move data between apps, trigger scripts on a schedule, and glue together [...] ## Announcing the Appwrite OAuth2 server: Turn your project into an identity provider DevFeed: [Announcing the Appwrite OAuth2 server: Turn your project into an identity provider]() Original publisher: [Read original article]() Author: Matej Bačo Published: 2026-09-04T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [OAuth 2.0](), [OpenID connect (OIDC)](), [Authorization](), [API](), [internal developer portal]() Tags: [announcements](), [api](), [authorization](), [developer-portal](), [github](), [oauth](), [oauth2](), [oidc](), [openid-connect](), [product](), [sdks]() ### AI overview Appwrite announces an OAuth2 server that lets projects act as OAuth 2.1 and OpenID Connect providers. Other applications can register as clients, obtain user-approved scoped access to APIs, and use standard authorization and token flows. ### Source excerpt Your Appwrite project can now act as an OAuth 2.1 and OpenID Connect provider, so other apps can offer Sign in with your product and request scoped access to your APIs. ## Announcing Appwrite Apps: Create apps that build on your users' Appwrite projects DevFeed: [Announcing Appwrite Apps: Create apps that build on your users' Appwrite projects]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-09-04T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [OAuth](), [OAuth 2.0](), [API keys](), [Authorization](), [API](), [migration]() Tags: [announcements](), [api-keys](), [apis](), [authorization](), [developers](), [documentation](), [oauth](), [oauth2](), [product]() ### AI overview Appwrite announces Appwrite Apps, allowing organizations to register applications that serve other Appwrite developers. The feature uses OAuth 2.1 and OpenID Connect for consent-based, scoped access to selected projects and organizations instead of pasted API keys. ### Source excerpt Register an app in your organization and build dashboards, deployment tools, CLIs, and agents for other Appwrite developers, with consent-based, scoped tokens instead of pasted API keys. ## Announcing Bitbucket support for Sites and Functions DevFeed: [Announcing Bitbucket support for Sites and Functions]() Original publisher: [Read original article]() Author: Harsh Mahajan Published: 2026-09-03T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [bitbucket](), [Appwrite](), [Deployment](), [Git]() Tags: [announcements](), [atlassian](), [bitbucket](), [build](), [deployment](), [git](), [oauth](), [pull-request](), [qr-code]() ### AI overview Appwrite announces Bitbucket support for Sites and Functions. Users can connect a Bitbucket workspace and repository so pushes trigger builds and deployments, with branch previews, Bitbucket links, commit statuses, pull request comments, logs, preview URLs, and QR codes. ### Source excerpt Appwrite now deploys from Bitbucket. Connect a workspace, pick a repository, and every push builds a Site or Function, with links that resolve to Bitbucket. ## What is MCP authorization? How OAuth works for AI agents DevFeed: [What is MCP authorization? How OAuth works for AI agents]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-03T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol (MCP)](), [OAuth](), [MCP Server](), [AI Agent](), [Authorization](), [Authentication]() Tags: [agents](), [authentication](), [authorization](), [discovery](), [mcp](), [oauth](), [scopes](), [token]() ### AI overview This tutorial explains MCP authorization as an OAuth 2.1 flow for allowing AI agents to call protected MCP servers on a user's behalf. It covers the roles of the MCP server, client, and authorization server; audience-bound tokens; discovery; deprecated Dynamic Client Registration; and step-up authorization for additional scopes. ### Source excerpt MCP authorization is the OAuth 2.1 flow that lets an AI agent call a protected MCP server on a user's behalf. Here is how it works, step by step, under the 2026-07-28 spec. ## OpenID Connect Authentication for MySQL, Now Fully Open Source DevFeed: [OpenID Connect Authentication for MySQL, Now Fully Open Source]() Original publisher: [Read original article]() Author: Michał Jankowski Published: 2026-09-02T08:56:26Z Content type: article Language: en Sources: [Blog - Percona]() Topics: [MySQL](), [OpenID connect (OIDC)](), [Authentication](), [JSON Web Tokens](), [OAuth](), [Open Source]() Tags: [authentication](), [jwks](), [jwt](), [mysql](), [oauth](), [oauth-2-0](), [oidc](), [open-source](), [openid-connect](), [percona](), [percona-server-for-mysql](), [percona-software](), [security]() ### AI overview Percona Server for MySQL includes an open-source OpenID Connect authentication plugin for specified 8.4 and 9.7 releases. The article explains how it authenticates users through standards-compliant identity providers and describes capabilities beyond the MySQL Enterprise plugin, including JWKS signing-key synchronization, group-to-role mapping, and proxy-user support. ### Source excerpt Percona Server for MySQL now ships with a fully open source OpenID Connect (OIDC) authentication plugin, available starting with Percona Server for MySQL 8.4.11-11 and 9.7.2-2 (not yet released as of this writing). It allows a MySQL account to authenticate against any standards-compliant Identity Provider (IdP) instead of relying on a locally stored password, closing ... Continued The post OpenID Connect Authentication for MySQL, Now Fully Open Source appeared first on Percona. ## Auth0 launches Early Access for enterprise-managed authorization in client apps DevFeed: [Auth0 launches Early Access for enterprise-managed authorization in client apps]() Original publisher: [Read original article]() Author: Mira Sharma Published: 2026-09-01T00:00:00Z Content type: release Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [Authorization](), [AI Agent](), [Model Context Protocol](), [OAuth](), [Single sign-on (SSO)]() Tags: [ai](), [ai-agent](), [authentication](), [enterprise](), [identity](), [mcp](), [model-context-protocol](), [oauth](), [release](), [saas](), [security](), [sso]() ### AI overview Auth0 announces Early Access for Client App capabilities that implement enterprise-managed authorization through Cross App Access and the ID-JAG draft specification. The feature lets an application or AI agent request access to external APIs or MCP servers using an employee's existing corporate SSO trust, reducing custom token-exchange work and supporting centralized governance. ### Source excerpt Implement Enterprise-Managed Authorization in Auth0 using Cross App Access (XAA) and ID-JAG. Build enterprise-ready AI agents without friction. ## OAuth token refresh has a race condition. Fix it with a conditional write, not a distributed lock. DevFeed: [OAuth token refresh has a race condition. Fix it with a conditional write, not a distributed lock.]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-31T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [OAuth](), [race-condition](), [Authorization](), [Auth0](), [Redis]() Tags: [auth0](), [authorization](), [concurrent](), [oauth](), [race-condition](), [redis](), [the-result]() ### AI overview This article explains how concurrent OAuth token refreshes can cause two distinct failures: stale tokens from lost updates and user disconnection when refresh-token rotation treats concurrent reuse as replay. It recommends layered defenses, including conditional writes, and explains why a Redis lock does not address both problems. ### Source excerpt Concurrent refreshes don't just fail. They can disconnect the user entirely. Here are four layers of defense, cheapest first, and why the Redis lock everyone reaches for isn't the one keeping you safe. [Next page]()