# Token Published articles for Token. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face DevFeed: [Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face]() Original publisher: [Read original article]() Author: Tom Hegel Published: 2026-09-16T10:00:34Z Content type: article Language: en Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.]() Topics: [Threat Research](), [Incident response](), [hugging face](), [OpenAI](), [ChatGPT](), [spaces](), [Flask](), [OAuth](), [HTTP]() Tags: [agentic-ai](), [agents](), [chatgpt](), [flask](), [http](), [hugging-face](), [incident-response](), [oauth](), [openai](), [research](), [spaces](), [token]() ### AI overview SentinelLABS traces activity associated with two Hugging Face accounts, 0Time and Nyx9, that appears to extend OpenAI's published chronology. The report describes relay-code commits, a workbook containing unexecuted-looking external probes, and a Flask-wrapped tool that could potentially provision ChatGPT identities or OAuth credentials if deployed and invoked. ### Source excerpt Two Hugging Face accounts reveal that OpenAI's agents staged relay code, internal probes and ChatGPT account registration beyond the published timeline. ## AWS STS simplifies session token size limits and adds session token size monitoring DevFeed: [AWS STS simplifies session token size limits and adds session token size monitoring]() Original publisher: [Read original article]() Author: Rishi Tripathy Published: 2026-09-15T22:21:59Z Content type: release Language: en Sources: [AWS Security Blog]() Topics: [Amazon Web Services](), [Security](), [Monitoring](), [Amazon CloudWatch](), [AWS CloudTrail](), [API]() Tags: [advanced-300](), [amazon-cloudwatch](), [apis](), [aws](), [aws-cloudtrail](), [aws-security-token-service](), [aws-sts](), [infrastructure](), [metrics](), [monitoring](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to](), [token]() ### AI overview AWS Security Token Service has replaced its separate packed policy and overall session token limits with a single 4,096-byte limit. It now reports session token size and limit utilization in API responses, Amazon CloudWatch metrics, and AWS CloudTrail events. ### Source excerpt AWS Security Token Service (AWS STS) has simplified session token size limits, giving you more room for your session policies and session tags. STS has replaced the packed policy size and the overall session token size limits with a single token size limit of 4,096 bytes. STS now reports session token size in API responses, [...] ## Architecting resilient authentication with Amazon Cognito multi-Region replication DevFeed: [Architecting resilient authentication with Amazon Cognito multi-Region replication]() Original publisher: [Read original article]() Author: Abrom Douglas Published: 2026-09-15T19:00:52Z Content type: tutorial Language: en Sources: [AWS Security Blog]() Topics: [Amazon Cognito](), [Replication](), [Authentication](), [identity and access management](), [Amazon Web Services](), [real-time](), [JSON Web Tokens]() Tags: [advanced-300](), [amazon-cognito](), [authentication](), [aws](), [failover](), [identity-and-access-management](), [real-time](), [replication](), [security-blog](), [security-identity-compliance](), [technical-how-to](), [token]() ### AI overview This AWS article explains how Amazon Cognito multi-Region replication supports resilient authentication by replicating user pools across AWS Regions, with eventual consistency, failover, and interoperable sessions and JSON web tokens. It also covers preparation, architecture decisions, and failover strategies for B2C, B2B, and M2M use cases. ### Source excerpt Your consumer identity and access management (CIAM) system is the foundation of your customer experience. It's how users sign in, access services, and engage with your applications. As your business scales across geographies, ensuring authentication is always available becomes a core architectural requirement. However, building multi-Region authentication has traditionally required complex custom replication solutions that [...] ## Inside the LLM Call: GenAI Observability with OpenTelemetry DevFeed: [Inside the LLM Call: GenAI Observability with OpenTelemetry]() Original publisher: [Read original article]() Author: OpenTelemetry Authors; Docs CC BY Published: 2026-09-14T16:56:42Z Content type: tutorial Language: en Sources: [Blog on OpenTelemetry]() Topics: [OpenTelemetry](), [agent observability](), [telemetry](), [AI Agent](), [Large Language Model]() Tags: [agent](), [ai-agent](), [claude-code](), [codex](), [observability](), [opentelemetry](), [token](), [tool](), [visibility]() ### AI overview This tutorial explains how OpenTelemetry Semantic Conventions for Generative AI record LLM calls, tool invocations, token counts, and related events. It demonstrates exporting telemetry from an LLM-powered application, viewing it with Aspire Dashboard, and considering sensitive-data implications of optional content capture. ### Source excerpt Your AI agent just took 45 seconds to answer a simple question. Was it the model? A slow tool call? A retry loop? Every time an application calls an LLM, a chain of model calls, tool invocations, and token exchanges happens behind the scenes -- and without observability, you are guessing. The OpenTelemetry Semantic Conventions for Generative AI give you that visibility. They standardize how GenAI operations are recorded -- the model being called, input and output token counts, and when opted in, the full content of prompts, completions, tool calls, and tool results. ## Accelerating Dropless MoE Training in JAX with NVIDIA Transformer Engine DevFeed: [Accelerating Dropless MoE Training in JAX with NVIDIA Transformer Engine]() Original publisher: [Read original article]() Author: Tanya Lenz Published: 2026-09-14T16:39:15Z Content type: article Language: en Sources: [NVIDIA Developer](), [NVIDIA Technical Blog]() Topics: [Mixture of Experts (MoE)](), [Artificial Intelligence](), [GPU](), [Large Language Model](), [Nvidia](), [Routing (disambiguation)](), [GB200](), [Network](), [Python](), [deepseek](), [mixtral](), [qwen]() Tags: [agentic-ai-generative-ai](), [ai](), [communication](), [deepseek](), [developer-tools-techniques](), [gb200](), [gpu](), [mixtral](), [mixture-of-experts-moe](), [mlops](), [moe](), [networks](), [nvfp4](), [nvidia](), [performance](), [python](), [qwen](), [router](), [routing](), [tensors](), [token](), [tokens](), [training-ai-models]() ### AI overview This article explains how NVIDIA Transformer Engine and JAX kernel optimizations accelerate dropless Mixture of Experts (MoE) training. It describes bottlenecks from token routing, expert dispatch and gathering, all-to-all communication, and ragged expert matrix operations. In DeepSeek-V3 training on NVIDIA GB200, the optimized approach increased performance from 103 to 1,068 TFLOPS per GPU, a 10.4x improvement. ### Source excerpt Mixture of experts (MoE) has become one of the defining architectural trends in large-scale AI model training. DeepSeek, Qwen, and Mixtral are examples of MoE... ## Using Exact-Match Response Caching to Reduce LLM Costs DevFeed: [Using Exact-Match Response Caching to Reduce LLM Costs]() Original publisher: [Read original article]() Author: Abhilash Rao Mesala Published: 2026-09-14T11:00:00Z Content type: article Language: en Sources: [The New Stack]() Topics: [Caching](), [Large Language Model]() Tags: [ai-engineering](), [ai-infrastructure](), [caching](), [contributed](), [cost](), [finops](), [generation](), [hash](), [llm](), [token]() ### AI overview The article explains how to reduce LLM costs by fingerprinting requests, context, model settings, and underlying data to create exact-match cache keys. Valid cached responses can be reused without calling the model. It distinguishes response caching from provider prompt caching, where only eligible prompt computation is reused. ### Source excerpt An LLM can answer the same question a thousand times and charge you each time. Before paying for another answer, The post Why an old caching trick is your secret to lower LLM costs appeared first on The New Stack. ## How WorkOS Vault's local encryption works DevFeed: [How WorkOS Vault's local encryption works]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-14T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Encryption](), [Cryptography](), [Security](), [data]() Tags: [cryptographic](), [data](), [encryption](), [pii](), [security](), [token]() ### AI overview The article explains how WorkOS Vault performs local encryption using envelope encryption. Each operation uses a single-use data encryption key, which is protected by a key encryption key stored in a hardware security module. Sensitive plaintext and ciphertext remain within the customer's infrastructure; only the wrapped key is sent to WorkOS. Key contexts automatically select or create isolated keys for organizations or tenants, with support for customer-managed keys and documented limits on context size and key counts. ### Source excerpt Envelope encryption, data keys, and why your sensitive data never has to leave your infrastructure ## Why You're Getting 429s in Production Using Auth0 and How to Stop Them DevFeed: [Why You're Getting 429s in Production Using Auth0 and How to Stop Them]() Original publisher: [Read original article]() Author: Carla Urrea Stabile Published: 2026-09-10T00:00:00Z Content type: tutorial Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [API](), [Authorization](), [Caching](), [JSON Web Tokens](), [Latency]() Tags: [apis](), [auth0](), [authorization](), [caching](), [errors](), [how-to](), [jwt](), [latency](), [production](), [token]() ### AI overview This tutorial explains why Auth0 API requests return 429 rate-limit errors in production. It identifies per-request Management API calls and repeatedly fetching machine-to-machine tokens as common causes, and recommends putting suitable authorization data in JWT claims, caching reusable tokens, logging rate-limit headers, and using short-lived tokens or live checks when changes must take effect immediately. ### Source excerpt Getting Auth0 429 status code errors in production? They almost always trace back to APIs rate limit. Here are the two causes and how to fix them. ## Introducing IP Allowlisting DevFeed: [Introducing IP Allowlisting]() Original publisher: [Read original article]() Author: Postmark team (fdossetto+postmark@activecampaign.com) Published: 2026-09-08T17:37:00Z Content type: release Language: en Sources: [Postmark (en-US)]() Topics: [Security](), [API](), [Network](), [Cloud]() Tags: [api](), [infrastructure](), [ip](), [nat](), [network](), [product-news](), [protection](), [range](), [request](), [security](), [token]() ### AI overview Postmark introduces IP Allowlisting, a security feature that restricts email sending through the Postmark API to up to 10 configured IP ranges in CIDR format. Requests from outside the allowed ranges are rejected with a 403 response. The ranges can be configured at the Server or account level, with Server settings overriding account settings. ### Source excerpt Good security is layered and each layer does a job the others can't. Scoping a token to a Server limits what it reaches. Rotating a token limits how long it lasts. Neither can say anything about where a request came from. We've been hard at work to ship a new layer of protection that can. IP Allowlisting is a new Postmark security feature that lets you name the infrastructure your email should come from. It's available now on all Postmark plans at no extra cost. It's off until you turn it on. How IP Allowlisting works You add up to 10 IP ranges, in CIDR format, that are allowed to send email using the Postmark API. Send requests from outside those ranges are rejected with a 403 status code that includes the IP the request came from. You can set your ranges in two places: On a Server. The ranges apply to that Server, covering every Message Stream on it. This is where we'd suggest starting. On your account. The ranges apply to every Server you have. When a Server has ranges of its own they will override account level settings. That's it! A straightforward security control to protect your API sending. Protect individual Servers or across your account. Set your Allowlist ranges on the account or Server. If you don't write CIDR blocks often, it's a quick 30 seconds to get familiar with them and the correct notation. CIDR blocks allow you to enable a grouped collection of IP addresses (aka ranges.) A CIDR block is an IP address followed by a suffix that says how many addresses it covers. The smaller the suffix, the wider the range: 198.51.100.24/32 one address, and only that address 203.0.113.0/24 256 addresses: 203.0.113.0 through 203.0.113.255 203.0.0.0/16 65,536 addresses: 203.0.0.0 through 203.0.255.255 So a /32 pins the allowlist to a single machine, and a /24 covers a subnet. Most teams end up somewhere in that span. Where you find your own ranges depends on how you send. A single VM has a static public IP you can read off your provider's dashboard. Cloud workloads ## How to Implement OIDC Back-Channel Logout DevFeed: [How to Implement OIDC Back-Channel Logout]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [OpenID connect (OIDC)](), [Single sign-on (SSO)](), [JSON Web Tokens](), [App](), [Server]() Tags: [how-to](), [implement](), [jwt](), [oidc](), [server](), [sso](), [token](), [tokens]() ### AI overview This tutorial explains OIDC back-channel logout, including provider discovery, endpoint registration, form-encoded logout requests, and logout-token validation. It also describes how session-specific and user-wide logout work and notes limitations acknowledged by the specification. ### Source excerpt It is the one standard that can end a session your app already issued, it has been final since 2022, and almost nobody implements it. Here is the whole mechanism, the validation your endpoint owes, and the two limitations the spec admits to itself. ## How to Reclaim Excess SOL After Rent Reduction DevFeed: [How to Reclaim Excess SOL After Rent Reduction]() Original publisher: [Read original article]() Author: Solana Foundation Published: 2026-09-03T15:15:00Z Content type: tutorial Language: en Sources: [Solana News Feed]() Topics: [Solana](), [Authorization](), [TypeScript]() Tags: [authorization](), [blockchain](), [blockchain-technology](), [crypto-news](), [cryptocurrency](), [defi](), [developers](), [how-to](), [nfts](), [podcasts](), [solana](), [solana-ecosystem](), [technology](), [token](), [typescript](), [upgrades](), [web3]() ### AI overview This tutorial explains how to reclaim excess SOL caused by Solana rent reductions. It covers withdrawing surplus lamports from token accounts and mints with WithdrawExcessLamports, and implementing similar reclaim logic for program-owned PDAs. ### Source excerpt Rent on Solana has been Reduced. Every Account Is Now Over-Funded. Here's How to Reclaim Excess SOL. ## What is MCP authorization? How OAuth works for AI agents DevFeed: [What is MCP authorization? How OAuth works for AI agents]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-03T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol (MCP)](), [OAuth](), [MCP Server](), [AI Agent](), [Authorization](), [Authentication]() Tags: [agents](), [authentication](), [authorization](), [discovery](), [mcp](), [oauth](), [scopes](), [token]() ### AI overview This tutorial explains MCP authorization as an OAuth 2.1 flow for allowing AI agents to call protected MCP servers on a user's behalf. It covers the roles of the MCP server, client, and authorization server; audience-bound tokens; discovery; deprecated Dynamic Client Registration; and step-up authorization for additional scopes. ### Source excerpt MCP authorization is the OAuth 2.1 flow that lets an AI agent call a protected MCP server on a user's behalf. Here is how it works, step by step, under the 2026-07-28 spec. ## Tokenization and the Migration of Money, Assets, and Ownership to Internet Infrastructure DevFeed: [Tokenization and the Migration of Money, Assets, and Ownership to Internet Infrastructure]() Original publisher: [Read original article]() Author: Solana Foundation Published: 2026-09-02T09:00:00Z Content type: opinion Language: en Sources: [Solana News Feed]() Topics: [tokenization](), [Blockchain](), [Internet](), [Finance]() Tags: [ai](), [blockchain](), [blockchain-technology](), [crypto-news](), [cryptocurrency](), [defi](), [finance](), [financial](), [infrastructure](), [internet](), [nfts](), [payments](), [podcasts](), [solana](), [solana-ecosystem](), [stablecoins](), [token](), [tokenization](), [web3]() ### AI overview This opinion article argues that tokenization is driving a long-term migration of money, assets, and ownership onto always-on internet infrastructure. It identifies stablecoins, institutional asset tokenization, blockchain infrastructure, and AI-enabled economic actors as converging forces that could broaden global distribution and access to markets. ### Source excerpt More than $4.7 trillion in stablecoins moved across Solana in the past year as tokenized markets expand access to ownership and finance. ## Track LLM API Costs with genai-prices DevFeed: [Track LLM API Costs with genai-prices]() Original publisher: [Read original article]() Author: Rick Donato Published: 2026-09-01T11:16:32Z Content type: tutorial Language: en Sources: [Packet Coders - Learn Network Automation]() Topics: [Large Language Model](), [API](), [Inference](), [Library](), [Python](), [Binance]() Tags: [api](), [cost](), [example](), [genai](), [inference](), [install](), [library](), [llm](), [openai](), [pricing](), [python](), [report](), [request](), [tips](), [token](), [uv]() ### AI overview A tutorial introducing the genai-prices Python library for estimating the cost of calling LLM inference APIs. It explains that the library can avoid maintaining a custom pricing table and can report token counts and cost for each request, with an OpenAI installation and usage example. ### Source excerpt Tip: Use the genai-prices Python library to calculate the estimated cost of calling LLM inference APIs. This avoids maintaining your own pricing table and lets you report token counts and cost for each request. Below is an example: # Install: uv add openai genai-prices from openai import OpenAI from ## MCP: Scope step-up is not authentication step-up DevFeed: [MCP: Scope step-up is not authentication step-up]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-01T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol](), [Authentication](), [Authorization](), [MCP Server]() Tags: [authentication](), [authorization](), [browser](), [compliance](), [delivery](), [mcp](), [mcp-server](), [model-context-protocol](), [permission](), [protocol](), [scope](), [token]() ### AI overview The article distinguishes MCP scope step-up from authentication step-up. MCP's current authorization flow addresses insufficient permission by obtaining broader scopes, but it does not standardize verifying whether a human recently authenticated or is still present. It recommends binding out-of-band approval to the user and exact operation until this changes. ### Source excerpt MCP standardized how an agent asks for more permission. It has no vocabulary yet for asking whether the human behind the token is still there. ## Refresh token behavior across fourteen providers DevFeed: [Refresh token behavior across fourteen providers]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-31T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [OAuth](), [API]() Tags: [providers](), [retry](), [rotation](), [token](), [tokens]() ### AI overview This article compares documented OAuth refresh-token behavior across fourteen providers, including token rotation, expiration reporting, grace periods, and revocation on reuse. It explains how rotation affects persistence and retry handling, with examples including Google, Box, Atlassian, Dropbox, Asana, GitHub, and Salesforce. ### Source excerpt Which providers rotate refresh tokens, which return expires_in, which give you a grace period, and which revoke on reuse. One row per provider, verified against provider documentation in August 2026. ## KV vs Prefix vs Prompt vs Semantic Caching DevFeed: [KV vs Prefix vs Prompt vs Semantic Caching]() Original publisher: [Read original article]() Author: Avi Chawla Published: 2026-08-27T20:01:47Z Content type: article Language: en Sources: [Daily Dose of Data Science]() Topics: [Caching](), [Large Language Model](), [Neo4j]() Tags: [caching](), [embedding](), [knowledge-graph](), [latency](), [llm](), [memory](), [nvme](), [object-storage](), [retrieval](), [server](), [token](), [vector]() ### AI overview The article distinguishes KV caching, prefix caching, prompt caching, and semantic caching in LLM systems. It explains what each cache stores, how exact-match and fuzzy-match behavior differ, and how cache misses affect cost, latency, and correctness. It also describes Konig's tiered storage approach for many small knowledge graphs, though the supplied text is truncated. ### Source excerpt ...explained with best practices in production. ## Vercel Connect now supports Linq DevFeed: [Vercel Connect now supports Linq]() Original publisher: [Read original article]() Author: Dima Voytenko Published: 2026-08-25T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [Messaging](), [API](), [OpenID connect (OIDC)](), [Command-line interface](), [SDKs](), [dashboards](), [Deployment]() Tags: [agent](), [agents](), [api](), [apps](), [cli](), [deployment](), [identity](), [oidc](), [partner](), [production](), [sdk](), [token](), [vercel]() ### AI overview Vercel Connect now offers a managed Linq connector that lets applications and agents send and receive messages through iMessage, RCS, and SMS. It can provision or link Linq accounts and phone numbers, manage credentials, and integrate with eve through a configured channel. Projects can use the @vercel/connect SDK and deployment OIDC identity to obtain short-lived Linq tokens for Linq Partner API requests. ### Source excerpt Vercel Connect now includes a managed connector for Linq, so your apps and agents can send and receive messages over iMessage, RCS, and SMS. As a Vercel Managed Connector, Vercel can create a Linq account and phone number for you, or link an existing account. You never manage credentials yourself. Create a connector from the dashboard or Vercel CLI: Give your eve agent a phone number The connector powers the new Linq channel in eve. Run eve add channel/linq, choose Vercel Connect, and eve wires up the connector, phone numbers, and webhook for you: The channel marks accepted messages as read and continues the same eve session for every message in a Linq conversation. Out of the box, the channel supports read receipts, typing indicators, and mid-conversation steering for a more natural messaging experience. Use the connector in any project Call getToken with your connector, and the @vercel/connect SDK exchanges your Vercel deployment's OIDC identity for a short-lived Linq token. Pass it as the bearer token on any Linq Partner API request: Linq delivers each message over the best protocol the recipient supports, starting with iMessage, then RCS, then SMS. The same token works across the full Linq API, including group chats, reactions, rich media, and typing indicators. Read the Vercel Connect documentation, view details about the Linq connector in the Vercel Connect catalog, or create a Linq connector to get started. Read more ## How Postman Passport keeps API secrets inside your network DevFeed: [How Postman Passport keeps API secrets inside your network]() Original publisher: [Read original article]() Author: Talia Kohan Published: 2026-08-24T16:00:00Z Content type: article Language: en Sources: [Postman Blog]() Topics: [API](), [Postman](), [API keys](), [Security](), [Architecture & Design](), [Network]() Tags: [api](), [api-keys](), [api-security](), [architecture](), [general](), [network](), [postman-passport](), [secret-store](), [secrets](), [secrets-management](), [security](), [token]() ### AI overview Postman Passport keeps real API secrets inside an organization's network by issuing credential references instead of exposing underlying keys. An internal proxy resolves the references, injects the credentials, and forwards requests while cryptographically binding references to their authorized holders. ### Source excerpt Postman Passport grants API access using credential references, keeping the real secret inside your network. Here's how the architecture works. The post How Postman Passport keeps API secrets inside your network appeared first on Postman Blog. ## Add Cross App Access to Your OIDC Resource Application DevFeed: [Add Cross App Access to Your OIDC Resource Application]() Original publisher: [Read original article]() Author: Sohail Pathan Published: 2026-08-24T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OpenID connect (OIDC)](), [API](), [Authorization](), [JSON Web Tokens](), [Single sign-on (SSO)](), [OAuth 2.0]() Tags: [api](), [authorization](), [cross-app-access](), [jwt](), [oauth-2-0](), [oidc](), [okta](), [scopes](), [sso](), [token](), [xaa]() ### AI overview This guide explains how OIDC-federated applications can support Cross App Access (XAA) for API access on behalf of users. It covers validating and redeeming the ID-JAG, resolving users from claims, issuing access tokens, updating authorization server metadata, and testing the end-to-end flow. ### Source excerpt If you currently federate enterprise customers using OpenID Connect (OIDC) and want to allow applications to access your API on behalf of those users, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your authorization server already trusts the customer's IdP for single sign-on (SSO), and XAA reuses that same trust for API access. This guide details what you need to support, how to validate the grant, and how to resolve the user at your resource authorization server. Table of Contents How XAA in OIDC works Analyzing the ID-JAG claims XAA implementation checklist for OIDC-federated applications Mapping user identity from iss and sub Validating the ID-JAG and resolving the user Issuing the access token Updating authorization server metadata Making cross-application requests from your OIDC app securely Configure your XAA OIDC Resource app in Okta Create the OIDC requesting app for testing Create the OIDC resource app in Okta Register and configure the AI Agent in Okta Verify your Okta XAA setup on xaa.dev Configure OIDC SSO Verify the refresh token exchange for an ID-JAG token Redeem the ID-JAG for an access token at the resource authorization server Call the resource API with the access token Prove the XAA connection end-to-end Takeaways for implementors who also have SAML apps Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the customer's Identity Provider (IdP) for your authorization server. Your resource server accepts the token, identifies the user, and issues your own access token, all while leaving the customer's existing OIDC integration untouched. The sequence diagram shown below describes the OIDC XAA flow. Notice that the OIDC SSO flow stays the ## Add Cross App Access to Your OIDC Requesting Application DevFeed: [Add Cross App Access to Your OIDC Requesting Application]() Original publisher: [Read original article]() Author: Sohail Pathan Published: 2026-08-21T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OpenID connect (OIDC)](), [OAuth](), [OAuth 2.0](), [JSON Web Tokens](), [API](), [Authorization](), [AI Agent]() Tags: [agent](), [api](), [authorization](), [callback](), [claude](), [cross-app-access](), [identity](), [jwt](), [oauth](), [oauth-2-0](), [oidc](), [openid-connect](), [sso](), [third-party-applications](), [token](), [xaa]() ### AI overview This guide explains how an OIDC-federated application can use Cross App Access (XAA) to request resources from a third-party application. It describes exchanging a refresh token for an Identity Assertion Authorization Grant, exchanging that short-lived JWT for an OAuth access token, and using the access token for the resource API request. ### Source excerpt If you currently federate enterprise customers using OpenID Connect (OIDC) and want to connect with third-party applications, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your app already holds an ID token after sign-in, but it's the refresh token from that same sign-in that you exchange to reach a third-party app. This guide details what you need to support and how to make resource requests to a third-party app using XAA. Table of Contents How XAA in OIDC works XAA implementation checklist for OIDC-federated applications Request the ID-JAG token Request the access token Call the resource API Handle token expiration Making cross-application requests from your OIDC app securely Configure your XAA OIDC requesting app in Okta Register the requesting app in Okta Register the test resource app in Okta Register your requesting app at xaa.dev Register and configure the AI Agent in Okta Validate the XAA connection end-to-end Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the Identity Provider (IdP) for your app's user. You exchange the ID-JAG token for an access token to the resource application you're connecting with. The sequence diagram below describes the OIDC XAA flow and how your application fits into it. You'll handle the flow in two parts: where your application requests the ID-JAG from the IdP using the refresh token, and where your app requests the access token from the ID-JAG from the third-party resource app's authorization server. XAA implementation checklist for OIDC-federated applications Follow the guide in this section to support XAA in your OIDC application when your app connects to a third-party resource application. The XAA flow places t ## How Reasoning Traces Work in Language Models DevFeed: [How Reasoning Traces Work in Language Models]() Original publisher: [Read original article]() Author: Armin Ronacher Published: 2026-08-19T00:00:00Z Content type: article Language: en Sources: [Armin Ronacher]() Topics: [Chain-of-thought](), [gpt-oss](), [Parser](), [API](), [Cache]() Tags: [ai](), [api](), [chain-of-thought](), [gpt-oss](), [reasoning](), [token]() ### AI overview The article explains reasoning traces as text emitted by a model into a scratchpad before its final answer. It discusses how GPT-OSS uses channel markers and a parser to route analysis into a separate stream, and argues that reasoning effort is shaped by system prompts and training rather than being solely a sampling-process property. ### Source excerpt A few weeks ago a paper was shared that showed how to extract reasoning traces from closed-weight models. Together with online discussions about tricking models into leaking them, it made me investigate it more out of curiosity. Twitter seems full of half-truths and confusion about how this works, so perhaps this helps some to understand what is happening. Hiding Traces Reasoning traces are usually hidden from us. We have lamented this, but mostly have to accept it. Open-weight models thankfully reveal them, and from their behavior you can see that their traces can be long and confusing. This is probably a good reason to separate them from what is normally shown to users. At minimum, UIs need to detect them. The industry has done a good job at making reasoning traces sound special and exotic, but they really are just text: the model is trained to emit its thinking into a scratchpad as part of its response, before its final answer. GPT-OSS's Harmony response format makes this easy to see: <|channel|>analysis<|message|> I need to work this out ... <|end|><|start|>assistant<|channel|>final<|message|> The answer is ... <|return|> The markers are special tokens, but the reasoning between them uses "the same text" as the final answer (just that GPT chain-of-thought text sounds really funny). When the model samples the analysis channel token, a parser routes the following text into a separate stream exposed through the Responses API. For closed models, presumably a simple model redacts and summarizes it. Reasoning Effort How much budget goes to reasoning? Earlier APIs exposed reasoning token budgets, making it seem like a property of the sampling process. In reality, reasoning effort is baked into the system prompt. GPT-OSS puts this into the system prompt: Reasoning: low That's it. Training produces the resulting behavior, such as emitting the token sequence that switches to the analysis channel. This also explains why changing the effort invalidates the KV cache. I think ## Grok 4.6: 500K Context, Pricing, and Agentic Coding Features DevFeed: [Grok 4.6: 500K Context, Pricing, and Agentic Coding Features]() Original publisher: [Read original article]() Author: Aishwari Pahwa Published: 2026-08-13T00:00:00Z Content type: article Language: en Sources: [Appwrite Blog]() Topics: [Frontier Model](), [long-context](), [coding](), [API](), [Fine-tuning](), [Reinforcement learning]() Tags: [agentic](), [agents](), [ai](), [api](), [benchmarks](), [coding](), [context-window](), [fine-tuning](), [frontier-model](), [reinforcement-learning](), [token](), [web-development]() ### AI overview This article describes Grok 4.6, focusing on long-running agents, coding, interactive and visual work, its 500K-token context window, pricing, benchmarks, and API availability. It also outlines claimed training changes, longer task trajectories, and self-testing or verification during multi-step work. ### Source excerpt Grok 4.6 is SpaceXAI's frontier model for long-running agents and coding. See full benchmarks, token pricing, the 500K context window, and API setup. ## Give a scheduled agent access to a user's Google, Slack, and Jira with no signed-in session DevFeed: [Give a scheduled agent access to a user's Google, Slack, and Jira with no signed-in session]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-12T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Tutorial](), [API keys](), [Authorization](), [OAuth](), [Slack](), [Google]() Tags: [agent](), [api](), [audit](), [auth0](), [authorization](), [autonomous-agents](), [browser](), [google](), [jira](), [logging](), [rotation](), [scheduled](), [scopes](), [slack](), [token](), [tokens](), [tutorial]() ### AI overview A tutorial showing how to give scheduled workers access to a user's Google, Slack, and Jira through WorkOS Pipes without a signed-in session. It covers scoped credential retrieval, token relay, rotation, revocation, and audit logging. ### Source excerpt A runnable tutorial for pulling per-connection third-party credentials from WorkOS Pipes with nobody logged in, plus relay, rotation, revocation, and audit logging. [Next page]()