# pkce

Published articles for pkce.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Laravel MCP 1.0 Is Released

DevFeed: [Laravel MCP 1.0 Is Released](<https://devfeed.tech/articles/laravel-mcp-1-0-is-released-26975.md>)

Original publisher: [Read original article](<https://laravel-news.com/laravel-mcp-1-0>)

Author: Eric L. Barnes

Published: 2026-09-15T14:27:51Z

Content type: release

Language: en

Sources: [Laravel](<https://devfeed.tech/sources/laravel.md>)

Topics: [Laravel](<https://devfeed.tech/topics/laravel.md>), [Model Context Protocol (MCP)](<https://devfeed.tech/topics/model-context-protocol-mcp.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [pkce](<https://devfeed.tech/topics/pkce.md>), [Caching](<https://devfeed.tech/topics/caching.md>), [servers](<https://devfeed.tech/topics/servers.md>)

Tags: [caching](<https://devfeed.tech/tags/caching.md>), [context-window](<https://devfeed.tech/tags/context-window.md>), [laravel](<https://devfeed.tech/tags/laravel.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [news](<https://devfeed.tech/tags/news.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [servers](<https://devfeed.tech/tags/servers.md>)

### AI overview

Laravel MCP 1.0 is the first stable release of Laravel's package for building Model Context Protocol servers. It adds protocol revision 2026-07-28 support, searchable tool catalogs, cache hints, stateless request handling, OAuth changes requiring PKCE, and Client ID Metadata Documents.

### Source excerpt

Laravel MCP 1.0 ships protocol revision 2026-07-28, stateless servers, searchable tool catalogs, cache hints, and reworked OAuth with required PKCE. The post Laravel MCP 1.0 Is Released appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox.

## How to add Sign in with Appwrite to your app

DevFeed: [How to add Sign in with Appwrite to your app](<https://devfeed.tech/articles/how-to-add-sign-in-with-appwrite-to-your-app-16508.md>)

Original publisher: [Read original article](<https://appwrite.io/blog/post/sign-in-with-appwrite-guide>)

Author: Matej Bačo

Published: 2026-09-04T00:00:00Z

Content type: tutorial

Language: en

Sources: [Appwrite Blog](<https://devfeed.tech/sources/appwrite-blog.md>)

Topics: [Appwrite](<https://devfeed.tech/topics/appwrite.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [pkce](<https://devfeed.tech/topics/pkce.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [oauth2](<https://devfeed.tech/tags/oauth2.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [sign-in](<https://devfeed.tech/tags/sign-in.md>), [tutorials](<https://devfeed.tech/tags/tutorials.md>)

### AI overview

A tutorial for enabling Appwrite's built-in OAuth2 provider so users can sign in to an app with their Appwrite account. It explains the consent and authorization-code flow, PKCE protection, and provider setup in the Appwrite Console.

### Source excerpt

Let users log in with their Appwrite account using the built-in OAuth2 provider. Learn how the flow works and how to set it up end to end.

## WorkOS Pipes: Where your users' tokens actually live

DevFeed: [WorkOS Pipes: Where your users' tokens actually live](<https://devfeed.tech/articles/workos-pipes-where-your-users-tokens-actually-live-16075.md>)

Original publisher: [Read original article](<https://workos.com/blog/workos-pipes-where-your-users-tokens-actually-live>)

Author: WorkOS

Published: 2026-08-28T00:00:00Z

Content type: tutorial

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [Encryption](<https://devfeed.tech/topics/encryption.md>), [Security](<https://devfeed.tech/topics/security.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [pkce](<https://devfeed.tech/topics/pkce.md>), [API](<https://devfeed.tech/topics/api.md>), [migration](<https://devfeed.tech/topics/migration.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [migration](<https://devfeed.tech/tags/migration.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [organization](<https://devfeed.tech/tags/organization.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [security](<https://devfeed.tech/tags/security.md>)

### AI overview

This article explains how WorkOS Pipes stores and protects users' OAuth and other connection credentials. It distinguishes connection metadata from credential values, describes scoped access and AES-256 encryption at rest, covers PKCE support and security posture, and discusses migrating existing tokens and the validation risks of updates.

### Source excerpt

A walk through the Pipes credential vault: envelope encryption, key context, what a compromised key reaches, and how key rotation happens without re-consent.

## Add sign-in to an Android app with the WorkOS Android SDK

DevFeed: [Add sign-in to an Android app with the WorkOS Android SDK](<https://devfeed.tech/articles/add-sign-in-to-an-android-app-with-the-workos-android-sdk-16062.md>)

Original publisher: [Read original article](<https://workos.com/blog/sign-in-to-an-android-app-with-the-workos-android-sdk>)

Author: WorkOS

Published: 2026-08-24T00:00:00Z

Content type: tutorial

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [Android](<https://devfeed.tech/topics/android.md>), [SDKs](<https://devfeed.tech/topics/sdks.md>), [Kotlin](<https://devfeed.tech/topics/kotlin.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [pkce](<https://devfeed.tech/topics/pkce.md>), [Gradle](<https://devfeed.tech/topics/gradle.md>), [Coroutines](<https://devfeed.tech/topics/coroutines.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [Security](<https://devfeed.tech/topics/security.md>), [Maven Central](<https://devfeed.tech/topics/maven-central.md>), [Mobile](<https://devfeed.tech/topics/mobile.md>)

Tags: [android](<https://devfeed.tech/tags/android.md>), [api](<https://devfeed.tech/tags/api.md>), [api-keys](<https://devfeed.tech/tags/api-keys.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [coroutines](<https://devfeed.tech/tags/coroutines.md>), [flow](<https://devfeed.tech/tags/flow.md>), [gradle](<https://devfeed.tech/tags/gradle.md>), [kotlin](<https://devfeed.tech/tags/kotlin.md>), [maven-central](<https://devfeed.tech/tags/maven-central.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [sdk](<https://devfeed.tech/tags/sdk.md>), [security](<https://devfeed.tech/tags/security.md>), [sign-in](<https://devfeed.tech/tags/sign-in.md>), [tutorial](<https://devfeed.tech/tags/tutorial.md>)

### AI overview

This tutorial shows how to add WorkOS AuthKit sign-in to a Kotlin Android app using the WorkOS Android SDK. It covers the Gradle dependency, Chrome Custom Tab authentication, custom-scheme redirects, PKCE token exchange, session storage and refresh, and logout without embedding a client secret in the APK.

### Source excerpt

Build a complete AuthKit flow in Kotlin, from Gradle dependency to signed-out state, with no client secret in your APK.

## Add native AuthKit sign-in to your iOS app with the WorkOS iOS SDK

DevFeed: [Add native AuthKit sign-in to your iOS app with the WorkOS iOS SDK](<https://devfeed.tech/articles/add-native-authkit-sign-in-to-your-ios-app-with-the-workos-ios-sdk-16021.md>)

Original publisher: [Read original article](<https://workos.com/blog/ios-sdk-authkit-sign-in-tutorial>)

Author: WorkOS

Published: 2026-08-10T00:00:00Z

Content type: tutorial

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [iOS](<https://devfeed.tech/topics/ios.md>), [pkce](<https://devfeed.tech/topics/pkce.md>), [SDKs](<https://devfeed.tech/topics/sdks.md>), [Swift](<https://devfeed.tech/topics/swift.md>), [SwiftUI](<https://devfeed.tech/topics/swiftui.md>), [Mobile](<https://devfeed.tech/topics/mobile.md>), [browser](<https://devfeed.tech/topics/browser.md>)

Tags: [authorization](<https://devfeed.tech/tags/authorization.md>), [browser](<https://devfeed.tech/tags/browser.md>), [guide](<https://devfeed.tech/tags/guide.md>), [ios](<https://devfeed.tech/tags/ios.md>), [mobile](<https://devfeed.tech/tags/mobile.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [sdk](<https://devfeed.tech/tags/sdk.md>), [sign-in](<https://devfeed.tech/tags/sign-in.md>), [swift](<https://devfeed.tech/tags/swift.md>), [swiftui](<https://devfeed.tech/tags/swiftui.md>), [tutorial](<https://devfeed.tech/tags/tutorial.md>)

### AI overview

A step-by-step tutorial for adding native AuthKit sign-in to a SwiftUI iOS app using the WorkOS iOS SDK and its PublicClient. It explains configuring redirect URIs, adding the SDK, and starting a PKCE flow without embedding an API key or client secret in the app.

### Source excerpt

A step-by-step guide to PKCE-based sign-in with the WorkOS iOS SDK's PublicClient.

## Build a Flask App with Okta for Secure OIDC Login and Authorized API Calls

DevFeed: [Build a Flask App with Okta for Secure OIDC Login and Authorized API Calls](<https://devfeed.tech/articles/build-a-flask-app-with-okta-for-secure-oidc-login-and-authorized-api-calls-15973.md>)

Original publisher: [Read original article](<https://developer.okta.com/blog/2026/07/28/flask-oauth-web-app>)

Author: Akanksha Bhasin

Published: 2026-07-28T05:00:00Z

Content type: tutorial

Language: en

Sources: [Okta Developer](<https://devfeed.tech/sources/okta-developer.md>)

Topics: [Flask](<https://devfeed.tech/topics/flask.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Tutorial](<https://devfeed.tech/topics/tutorial.md>), [API](<https://devfeed.tech/topics/api.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [Python](<https://devfeed.tech/topics/python.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [flask](<https://devfeed.tech/tags/flask.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [python](<https://devfeed.tech/tags/python.md>), [security](<https://devfeed.tech/tags/security.md>), [tutorial](<https://devfeed.tech/tags/tutorial.md>), [web-app](<https://devfeed.tech/tags/web-app.md>)

### AI overview

This tutorial explains how to build a Flask dashboard that uses Okta OpenID Connect for user sign-in and OAuth 2.0 access tokens to call a protected backend API. It also covers PKCE, custom scopes, self-service registration, and validating scopes to control API responses.

### Source excerpt

Python syntax and the flexibility of the Flask microframework make it a popular choice for quickly building web applications. While Flask provides the essentials to get you started, you'll need to tackle two critical pieces yourself: secure user authentication and authorization for your backend services. After all, how do you securely sign users into your application? And once they're signed in, how does your app fetch data from a backend service that only serves authorized requests? This tutorial shows you how to solve both. You'll build a Flask dashboard app that signs users in with Okta using OpenID Connect (OIDC). Once signed in, the app uses the resulting OAuth 2.0 access token to call a separate backend API that responds only to authorized requests. In this common pattern, a web app needs to fetch data from a protected backend service. You'll use Authlib, an OIDC client library, to configure the Authorization Code flow with Proof Key for Code Exchange (PKCE) automatically. You'll also learn how to add a custom scope to the access token and validate it on the backend to control what data the API returns. Check out the complete source code on GitHub and get started without setting it up from scratch. Table of Contents Build a Flask app with OIDC authentication Create an app integration in the Okta Admin Console Enable self-service user registration Add secure user login to a Flask application with Okta Create a basic Flask web application Configure Flask environment variables Implement the OIDC authentication logic Run the Flask OAuth web app Call a protected API with OAuth scoped tokens Build a protected users API Extend the Flask app to interact with the resource server Update the Flask UI to display protected data Test the protected API integration Learn more about OAuth and OIDC Build a Flask app with OIDC authentication In this tutorial, you'll build a simple dashboard application and learn how to: Securely sign users in to view their profile information us

## Build a Secure C# MCP App with Cross App Access (XAA)

DevFeed: [Build a Secure C# MCP App with Cross App Access (XAA)](<https://devfeed.tech/articles/build-a-secure-c-mcp-app-with-cross-app-access-xaa-15971.md>)

Original publisher: [Read original article](<https://developer.okta.com/blog/2026/07/16/csharp-mcp-cross-app-access>)

Author: Aasawari Sahasrabuddhe

Published: 2026-07-16T05:00:00Z

Content type: tutorial

Language: en

Sources: [Okta Developer](<https://devfeed.tech/sources/okta-developer.md>)

Topics: [cross-app-access](<https://devfeed.tech/topics/cross-app-access.md>), [Model Context Protocol (MCP)](<https://devfeed.tech/topics/model-context-protocol-mcp.md>), [C#](<https://devfeed.tech/topics/csharp.md>), [SDKs](<https://devfeed.tech/topics/sdks.md>), [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [API](<https://devfeed.tech/topics/api.md>)

Tags: [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [api](<https://devfeed.tech/tags/api.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [c-sharp](<https://devfeed.tech/tags/c-sharp.md>), [cross-app-access](<https://devfeed.tech/tags/cross-app-access.md>), [csharp](<https://devfeed.tech/tags/csharp.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [sdk](<https://devfeed.tech/tags/sdk.md>), [xaa](<https://devfeed.tech/tags/xaa.md>)

### AI overview

This tutorial explains how Cross App Access (XAA) extends user identity and enterprise policy to downstream applications, MCP servers, APIs, and agent tools. It demonstrates the XAA token-exchange flow and shows how to implement a secure MCP client in C# with an MCP SDK.

### Source excerpt

A few years ago, getting a user signed in to an application or multiple applications with Single Sign-On (SSO) was enough; OpenID Connect (OIDC) handled the login, JWTs carried the claims, and Proof Key for Code Exchange (PKCE) made it secure. Today, with evolving AI, agents act on behalf of users and seek multiple accesses across different resources to execute a task. And that is when you'll hit the gap. The user has an identity, but the downstream service--like a Model Context Protocol (MCP) server, an API, or an agent tool has no way to trust it: the ID Token that proves the user's identity for your app, not for that service. You need a way to take that identity and have it trusted further down the chain, in line with the org's policy, without asking the user to log in again. Cross App Access (XAA) solves exactly that. The user authenticates once. The Identity Provider (IdP) evaluates the enterprise policy and issues a signed Identity Assertion. The downstream service exchanges that assertion for a scoped Bearer token. In this post, we'll explore how Cross App Access (XAA) closes the trust gap, test the flow using an XAA playground, and implement a secure MCP client in just a few lines of C# using our dedicated SDK. Table of Contents What is Cross App Access (XAA)? Implementing XAA with the C# MCP SDK Building the OIDC flow Automate XAA token exchange with C# SDK Connect the MCP client to the server Testing your C# MCP app with xaa.dev Run your C# MCP app with xaa.dev Learn More About Secure AI Agent Development with C# and MCP What is Cross App Access (XAA)? Before we start implementing and building the application, it is important to understand the mechanics of Cross App Access (XAA). At its core, XAA is an open standard that securely enables AI agents to act on behalf of a user and communicate with downstream applications without requiring constant, manual user consent. While the flow is sophisticated, it relies on two standard interactions: RFC 8693 (Token Exc

## The Complicating Factors of Deploying MCP in the Enterprise

DevFeed: [The Complicating Factors of Deploying MCP in the Enterprise](<https://devfeed.tech/articles/the-complicating-factors-of-deploying-mcp-in-the-enterprise-29612.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/complicating-mcp-enterprise/>)

Author: boris.kurktchiev@goteleport.com (Boris Kurktchiev)

Published: 2026-03-20T00:00:00Z

Content type: opinion

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [Security](<https://devfeed.tech/topics/security.md>), [pkce](<https://devfeed.tech/topics/pkce.md>)

Tags: [auth](<https://devfeed.tech/tags/auth.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [blog](<https://devfeed.tech/tags/blog.md>), [enterprise](<https://devfeed.tech/tags/enterprise.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [production](<https://devfeed.tech/tags/production.md>), [security](<https://devfeed.tech/tags/security.md>), [trust](<https://devfeed.tech/tags/trust.md>)

### AI overview

Boris Kurktchiev discusses the practical challenges of deploying MCP in enterprise production environments. The article describes how MCP's authentication model evolved from implicit trust and stdio-only use toward OAuth 2.1, separated authorization responsibilities, enterprise extensions, and mandatory PKCE.

### Source excerpt

Deploying MCP into production environments is complicated. In this blog, Boris Kurktchiev explains why.

## Writing a Keycloak-PKCE Library in C++

DevFeed: [Writing a Keycloak-PKCE Library in C++](<https://devfeed.tech/articles/writing-a-keycloak-pkce-library-in-c-25141.md>)

Original publisher: [Read original article](<https://blog.brakmic.com/writing-a-keycloak-pkce-library-in-c/>)

Author: brakmic

Published: 2025-02-28T18:48:58Z

Content type: article

Language: en

Sources: [Harris Brakmic - Coding](<https://devfeed.tech/sources/harris-brakmic-coding.md>)

Topics: [C++](<https://devfeed.tech/topics/c-plus-plus.md>), [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [pkce](<https://devfeed.tech/topics/pkce.md>), [Library](<https://devfeed.tech/topics/library.md>), [C](<https://devfeed.tech/topics/c.md>), [Programming](<https://devfeed.tech/topics/programming.md>), [Python](<https://devfeed.tech/topics/python.md>), [Lua](<https://devfeed.tech/topics/lua.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [article](<https://devfeed.tech/tags/article.md>), [c](<https://devfeed.tech/tags/c.md>), [c-plus-plus](<https://devfeed.tech/tags/c-plus-plus.md>), [coding](<https://devfeed.tech/tags/coding.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [learning](<https://devfeed.tech/tags/learning.md>), [library](<https://devfeed.tech/tags/library.md>), [lua](<https://devfeed.tech/tags/lua.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [programming](<https://devfeed.tech/tags/programming.md>), [python](<https://devfeed.tech/tags/python.md>)

### AI overview

A personal article about building a C++ library that supports PKCE with Keycloak. The project includes a C wrapper with a stable ABI and additional Python and Lua wrappers, and is presented primarily as a learning exercise rather than a production-ready library.

### Source excerpt

This article offers a personal look at a C++ library implementing PKCE with Keycloak. It's intended more as a learning exercise than a production-ready solution. You'll find a C wrapper and additional Python and Lua wrappers, plus a quick rundown on PKCE fundamentals, library structure, and example demos.

## Keycloak, Angular, and the BFF Pattern

DevFeed: [Keycloak, Angular, and the BFF Pattern](<https://devfeed.tech/articles/keycloak-angular-and-the-bff-pattern-25134.md>)

Original publisher: [Read original article](<https://blog.brakmic.com/keycloak-angular-and-the-bff-pattern/>)

Author: brakmic

Published: 2025-01-26T10:58:39Z

Content type: tutorial

Language: en

Sources: [Harris Brakmic - Coding](<https://devfeed.tech/sources/harris-brakmic-coding.md>)

Topics: [BFF](<https://devfeed.tech/topics/bff.md>), [Angular](<https://devfeed.tech/topics/angular.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Express](<https://devfeed.tech/topics/express.md>), [Security](<https://devfeed.tech/topics/security.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>)

Tags: [angular](<https://devfeed.tech/tags/angular.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [bff](<https://devfeed.tech/tags/bff.md>), [coding](<https://devfeed.tech/tags/coding.md>), [express](<https://devfeed.tech/tags/express.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [oauth2](<https://devfeed.tech/tags/oauth2.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [security](<https://devfeed.tech/tags/security.md>), [typescript](<https://devfeed.tech/tags/typescript.md>), [web](<https://devfeed.tech/tags/web.md>), [web-applications](<https://devfeed.tech/tags/web-applications.md>)

### AI overview

This tutorial explains how to use the Backend for Frontend pattern with Angular, Express.js, and Keycloak to secure a web application. It describes handling OAuth2 and PKCE authentication flows server-side, storing tokens in server-side sessions, and keeping sensitive data out of the browser.

### Source excerpt

This article explains implementing the BFF pattern with Angular, Express.js, and Keycloak to secure web applications. Learn how to handle authentication flows server-side, eliminate client-side token storage, and maintain separation between frontend and security operations. Includes practical configuration steps for Keycloak realms, Express.js sessions, and Angular's authentication service.

## PKCE with Keycloak and Passport

DevFeed: [PKCE with Keycloak and Passport](<https://devfeed.tech/articles/pkce-with-keycloak-and-passport-25137.md>)

Original publisher: [Read original article](<https://blog.brakmic.com/pkce-with-keycloak-and-passport/>)

Author: brakmic

Published: 2025-01-20T12:09:12Z

Content type: tutorial

Language: en

Sources: [Harris Brakmic - Coding](<https://devfeed.tech/sources/harris-brakmic-coding.md>)

Topics: [pkce](<https://devfeed.tech/topics/pkce.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Security](<https://devfeed.tech/topics/security.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [Docker Compose](<https://devfeed.tech/topics/docker-compose.md>), [Single-page application (SPA)](<https://devfeed.tech/topics/spa.md>), [Testing](<https://devfeed.tech/topics/testing.md>), [TypeScript](<https://devfeed.tech/topics/typescript.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [coding](<https://devfeed.tech/tags/coding.md>), [docker](<https://devfeed.tech/tags/docker.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [oauth2](<https://devfeed.tech/tags/oauth2.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [security](<https://devfeed.tech/tags/security.md>), [testing](<https://devfeed.tech/tags/testing.md>), [typescript](<https://devfeed.tech/tags/typescript.md>)

### AI overview

A practical guide to using passport-keycloak-oauth2-oidc-portable with Keycloak, OAuth2, and OpenID Connect. It covers switching the library to TypeScript, adding integration and end-to-end tests, running a local Keycloak instance with Docker Compose, and implementing PKCE for public clients such as single-page applications.

### Source excerpt

Discover how passport-keycloak-oauth2-oidc-portable integrates Keycloak with OAuth2 and OpenID Connect (OIDC) using the secure Proof Key for Code Exchange (PKCE) protocol. This article explores implementing PKCE to protect public clients like desktop and single-page applications from common authentication vulnerabilities such as CSRF and authorization code interception. Learn about setting up a Keycloak test instance with Docker to facilitate seamless local development and testing. Through a practical example, see how PKCE aligns with modern security standards, providing a robust and efficient authentication mechanism for your applications. Whether you're enhancing existing authentication flows or building new solutions, this guide offers valuable insights into leveraging PKCE, Keycloak, and Passport.js to create secure authentication frameworks.

## Unlock a Better Mobile Experience with Square GraphQL and PKCE

DevFeed: [Unlock a Better Mobile Experience with Square GraphQL and PKCE](<https://devfeed.tech/articles/unlock-a-better-mobile-experience-with-square-graphql-and-pkce-15934.md>)

Original publisher: [Read original article](<https://developer.squareup.com/blog/unlock-a-better-mobile-experience-with-square-graphql-and-pkce>)

Author: Eva Sasson

Published: 2023-06-26T15:00:00Z

Content type: tutorial

Language: en

Sources: [Square Corner Blog RSS Feed](<https://devfeed.tech/sources/square-corner-blog-rss-feed.md>)

Topics: [GraphQL](<https://devfeed.tech/topics/graphql.md>), [Mobile](<https://devfeed.tech/topics/mobile.md>), [React Native](<https://devfeed.tech/topics/react-native.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [API](<https://devfeed.tech/topics/api.md>), [Android](<https://devfeed.tech/topics/android.md>), [iOS](<https://devfeed.tech/topics/ios.md>)

Tags: [android](<https://devfeed.tech/tags/android.md>), [api](<https://devfeed.tech/tags/api.md>), [apis](<https://devfeed.tech/tags/apis.md>), [graphql](<https://devfeed.tech/tags/graphql.md>), [ios](<https://devfeed.tech/tags/ios.md>), [mobile](<https://devfeed.tech/tags/mobile.md>), [mobile-development](<https://devfeed.tech/tags/mobile-development.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [react-native](<https://devfeed.tech/tags/react-native.md>)

### AI overview

A tutorial shows how to build a React Native mobile application for iOS and Android using Square GraphQL and OAuth PKCE. GraphQL combines API calls, while PKCE authorizes mobile clients to retrieve seller access tokens without a backend for the frontend.

### Source excerpt

Streamline the flow of your React Native application

## Supabase Beta April 2023

DevFeed: [Supabase Beta April 2023](<https://devfeed.tech/articles/supabase-beta-april-2023-601.md>)

Original publisher: [Read original article](<https://supabase.com/blog/supabase-beta-update-april-2023>)

Author: Ant Wilson

Published: 2023-05-09T07:00:00Z

Content type: article

Language: en

Sources: [Supabase Blog](<https://devfeed.tech/sources/supabase-blog.md>)

Topics: [Supabase](<https://devfeed.tech/topics/supabase.md>), [Deno](<https://devfeed.tech/topics/deno.md>), [Deployment](<https://devfeed.tech/topics/deployment.md>), [PostgreSQL](<https://devfeed.tech/topics/postgresql.md>), [API](<https://devfeed.tech/topics/api.md>), [Grafana](<https://devfeed.tech/topics/grafana.md>), [Single sign-on (SSO)](<https://devfeed.tech/topics/sso.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [api](<https://devfeed.tech/tags/api.md>), [apple](<https://devfeed.tech/tags/apple.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [github](<https://devfeed.tech/tags/github.md>), [ios](<https://devfeed.tech/tags/ios.md>), [launch](<https://devfeed.tech/tags/launch.md>), [libraries](<https://devfeed.tech/tags/libraries.md>), [logging](<https://devfeed.tech/tags/logging.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [postgresql](<https://devfeed.tech/tags/postgresql.md>), [sso](<https://devfeed.tech/tags/sso.md>), [updates](<https://devfeed.tech/tags/updates.md>)

### AI overview

A review of Supabase Launch Week 7 updates, including self-hosted logging and Edge Functions, resumable Storage uploads, expanded Auth features, new Supabase Studio AI capabilities, the dbdev PostgreSQL package manager, and additional API, search, and storage changes.

### Source excerpt

A review of Launch Week 7 and more exciting updates from last month.

## Supabase Auth: SSO, Mobile, and Server-side support

DevFeed: [Supabase Auth: SSO, Mobile, and Server-side support](<https://devfeed.tech/articles/supabase-auth-sso-mobile-and-server-side-support-583.md>)

Original publisher: [Read original article](<https://supabase.com/blog/supabase-auth-sso-pkce>)

Author: Stojan Dimitrovski; Joel Lee; Kang Ming Tay

Published: 2023-04-13T07:00:00Z

Content type: release

Language: en

Sources: [Supabase Blog](<https://devfeed.tech/sources/supabase-blog.md>)

Topics: [Supabase](<https://devfeed.tech/topics/supabase.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Single sign-on (SSO)](<https://devfeed.tech/topics/sso.md>), [Server-side rendering](<https://devfeed.tech/topics/server-side-rendering.md>), [Mobile](<https://devfeed.tech/topics/mobile.md>), [iOS](<https://devfeed.tech/topics/ios.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [PostgreSQL](<https://devfeed.tech/topics/postgresql.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [Self-hosted](<https://devfeed.tech/topics/self-hosted.md>)

Tags: [auth](<https://devfeed.tech/tags/auth.md>), [cli](<https://devfeed.tech/tags/cli.md>), [ios](<https://devfeed.tech/tags/ios.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [postgresql](<https://devfeed.tech/tags/postgresql.md>), [release](<https://devfeed.tech/tags/release.md>), [saml](<https://devfeed.tech/tags/saml.md>), [self-hosted](<https://devfeed.tech/tags/self-hosted.md>), [sso](<https://devfeed.tech/tags/sso.md>)

### AI overview

Supabase announces new Supabase Auth capabilities: SAML 2.0 support for enterprise Single Sign-On, PKCE support for server-side rendering and mobile applications, and native Sign in with Apple on iOS.

### Source excerpt

Supacharging Supabase Auth with Sign in with Apple on iOS, Single-Sign-On support with SAML 2.0, and PKCE for server-side rendering and mobile auth.

## New Keycloak maintainer: Takashi Norimatsu

DevFeed: [New Keycloak maintainer: Takashi Norimatsu](<https://devfeed.tech/articles/new-keycloak-maintainer-takashi-norimatsu-31588.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2021/10/takashi.adoc>)

Author: Stian Thorgersen

Published: 2021-10-18T00:00:00Z

Content type: news

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [openid](<https://devfeed.tech/topics/openid.md>), [Security](<https://devfeed.tech/topics/security.md>), [API](<https://devfeed.tech/topics/api.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [pkce](<https://devfeed.tech/topics/pkce.md>)

Tags: [api-security](<https://devfeed.tech/tags/api-security.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [idm](<https://devfeed.tech/tags/idm.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [sso](<https://devfeed.tech/tags/sso.md>)

### AI overview

Keycloak welcomes Takashi Norimatsu as an official maintainer. He will continue leading OAuth 2.0 and OpenID Connect security work, initially focusing on API security features for enterprise scenarios.

### Source excerpt

We are extremely pleased to welcome Takashi Norimatsu as an official maintainer of Keycloak. Takashi has contributed to Keycloak since 2017, with a focus on security features of OAuth 2.0 and OpenID Connect, such as PKCE, strong signature algorithms, and Certificate Bound Access Tokens. More recently, he has been leading development related to Financial-grade API (FAPI) in the FAPI special interest group. In addition he has been helping other developers in the area of API authorization, including giving presentations at multiple conferences. Takashi will continue leading development of OAuth 2.0 and OpenID Connect security related features, with an initial focus on features needed to provide higher level of API security for enterprise scenarios. Takashi works for Hitachi, Ltd. in Japan, which sees the real value of Keycloak especially in the API management area, allowing him to invest a significant portion of his time to the Keycloak project. The Keycloak team is very exited about having Takashi join us as a maintainer, and we are looking forward to working more closely with Takashi going forward.

## Using OAuth with PKCE Authorization Flow (Proof Key for Code Exchange)

DevFeed: [Using OAuth with PKCE Authorization Flow (Proof Key for Code Exchange)](<https://devfeed.tech/articles/using-oauth-with-pkce-authorization-flow-proof-key-for-code-exchange-37600.md>)

Original publisher: [Read original article](<https://www.taniarascia.com/oauth-pkce-authorization/>)

Author: hello@taniarascia.com

Published: 2021-06-20T00:00:00Z

Content type: tutorial

Language: en

Sources: [Tania Rascia](<https://devfeed.tech/sources/tania-rascia.md>)

Topics: [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [pkce](<https://devfeed.tech/topics/pkce.md>), [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Web app](<https://devfeed.tech/topics/webapp.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [client](<https://devfeed.tech/tags/client.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [security](<https://devfeed.tech/tags/security.md>), [token](<https://devfeed.tech/tags/token.md>)

### AI overview

This tutorial explains OAuth 2.0 authorization flows, distinguishes authorization from authentication with OpenID Connect, and describes why client-side and mobile applications use PKCE when client secrets cannot be protected.

### Source excerpt

If you've ever created a login page or auth system, you might be familiar with OAuth 2.0, the industry standard protocol for authorization...