# JSON Web Tokens JSON Web Token (JWT) is a compact, URL-safe format for representing claims between parties, using JSON Web Signature or JSON Web Encryption structures. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How to tell agent traffic from user traffic DevFeed: [How to tell agent traffic from user traffic]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-16T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [JSON Web Tokens](), [audit trail](), [audit](), [Security](), [Authorization]() Tags: [agent](), [audit](), [audit-trail](), [auth](), [how-to](), [logs](), [security]() ### AI overview This tutorial explains how to distinguish agent traffic from user traffic in access and audit logs. It describes identifying agent tokens with a claim, separating the acting agent from the delegating user, and recording both identities so automated changes can be queried accurately. ### Source excerpt Your access logs probably say a person did something an agent did. Four claims fix that, and one of them exists for exactly this purpose. ## Architecting resilient authentication with Amazon Cognito multi-Region replication DevFeed: [Architecting resilient authentication with Amazon Cognito multi-Region replication]() Original publisher: [Read original article]() Author: Abrom Douglas Published: 2026-09-15T19:00:52Z Content type: tutorial Language: en Sources: [AWS Security Blog]() Topics: [Amazon Cognito](), [Replication](), [Authentication](), [identity and access management](), [Amazon Web Services](), [real-time](), [JSON Web Tokens]() Tags: [advanced-300](), [amazon-cognito](), [authentication](), [aws](), [failover](), [identity-and-access-management](), [real-time](), [replication](), [security-blog](), [security-identity-compliance](), [technical-how-to](), [token]() ### AI overview This AWS article explains how Amazon Cognito multi-Region replication supports resilient authentication by replicating user pools across AWS Regions, with eventual consistency, failover, and interoperable sessions and JSON web tokens. It also covers preparation, architecture decisions, and failover strategies for B2C, B2B, and M2M use cases. ### Source excerpt Your consumer identity and access management (CIAM) system is the foundation of your customer experience. It's how users sign in, access services, and engage with your applications. As your business scales across geographies, ensuring authentication is always available becomes a core architectural requirement. However, building multi-Region authentication has traditionally required complex custom replication solutions that [...] ## AP2 Protocol Explained: How Agent Payments Get Authorized DevFeed: [AP2 Protocol Explained: How Agent Payments Get Authorized]() Original publisher: [Read original article]() Author: Ayush Agarwal Published: 2026-09-13T00:00:00Z Content type: article Language: en Sources: [Dodo Payments Blog]() Topics: [Authorization](), [AI Agent](), [Artificial Intelligence](), [JSON Web Tokens](), [Google]() Tags: [agent](), [agentic](), [ai](), [authentication](), [cryptographic](), [google](), [payments](), [tokens]() ### AI overview A practical explanation of AP2, an authorization and evidence protocol for AI agent payment transactions. It describes cryptographic proof, verifiable digital credentials, SD-JWTs, and separate checkout and payment mandates. ### Source excerpt A practical guide to AP2, the Agent Payments Protocol: checkout and payment mandates, open versus closed authorization, verifiable digital credentials, and what it means for merchants. ## Why You're Getting 429s in Production Using Auth0 and How to Stop Them DevFeed: [Why You're Getting 429s in Production Using Auth0 and How to Stop Them]() Original publisher: [Read original article]() Author: Carla Urrea Stabile Published: 2026-09-10T00:00:00Z Content type: tutorial Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [API](), [Authorization](), [Caching](), [JSON Web Tokens](), [Latency]() Tags: [apis](), [auth0](), [authorization](), [caching](), [errors](), [how-to](), [jwt](), [latency](), [production](), [token]() ### AI overview This tutorial explains why Auth0 API requests return 429 rate-limit errors in production. It identifies per-request Management API calls and repeatedly fetching machine-to-machine tokens as common causes, and recommends putting suitable authorization data in JWT claims, caching reusable tokens, logging rate-limit headers, and using short-lived tokens or live checks when changes must take effect immediately. ### Source excerpt Getting Auth0 429 status code errors in production? They almost always trace back to APIs rate limit. Here are the two causes and how to fix them. ## OIDC is a standard, identity providers are not DevFeed: [OIDC is a standard, identity providers are not]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-09T16:09:50Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [OpenID connect (OIDC)](), [interoperability](), [OAuth](), [JSON Web Tokens](), [Authentication]() Tags: [compatibility](), [interoperability](), [jwt](), [oauth](), [oidc](), [providers]() ### AI overview This article explains why generic OpenID Connect integrations often require provider-specific compatibility settings. It discusses differences in token-endpoint client authentication, including client secret basic, client secret POST, and private key JWT. ### Source excerpt Generic OIDC connections meet identity providers that read the same spec differently. Here are the per-connection compatibility settings we added, and why. ## Inside the ID-JAG: How enterprise-managed authorization actually works DevFeed: [Inside the ID-JAG: How enterprise-managed authorization actually works]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [Model Context Protocol](), [JSON Web Tokens](), [OAuth]() Tags: [authorization](), [enterprise](), [jwt](), [mcp](), [mcp-server](), [oauth]() ### AI overview This tutorial explains how the Enterprise-Managed Authorization extension to MCP uses ID-JAGs--short-lived, signed JWT authorization grants--to let an identity provider authorize a client to access an MCP resource server. The authorization server exchanges the ID-JAG for an access token, replacing repeated user consent screens with centrally managed enterprise authorization. The article notes that the ID-JAG draft remains an active IETF document even though the MCP extension is marked Stable. ### Source excerpt The consent screen is no longer where access gets decided. Here is what replaced it, and what your MCP server now has to validate. ## How to Implement OIDC Back-Channel Logout DevFeed: [How to Implement OIDC Back-Channel Logout]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [OpenID connect (OIDC)](), [Single sign-on (SSO)](), [JSON Web Tokens](), [App](), [Server]() Tags: [how-to](), [implement](), [jwt](), [oidc](), [server](), [sso](), [token](), [tokens]() ### AI overview This tutorial explains OIDC back-channel logout, including provider discovery, endpoint registration, form-encoded logout requests, and logout-token validation. It also describes how session-specific and user-wide logout work and notes limitations acknowledged by the specification. ### Source excerpt It is the one standard that can end a session your app already issued, it has been final since 2022, and almost nobody implements it. Here is the whole mechanism, the validation your endpoint owes, and the two limitations the spec admits to itself. ## Five Reasons Why Your Auth0 Permissions Are Not in your Access Token DevFeed: [Five Reasons Why Your Auth0 Permissions Are Not in your Access Token]() Original publisher: [Read original article]() Author: Carla Urrea Stabile Published: 2026-09-03T00:00:00Z Content type: tutorial Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [Authorization](), [JSON Web Tokens](), [AWS Identity and Access Management (IAM)]() Tags: [auth0](), [authorization](), [how-to](), [jwt](), [tokens]() ### AI overview A tutorial explaining five common reasons Auth0 RBAC permissions may be missing from an access token, including an omitted audience parameter, disabled permission settings, and incomplete role assignments. ### Source excerpt Decoding your Auth0 JWT and seeing an empty permissions array? Here are 5 common reasons your Auth0 RBAC permissions are missing and how to fix them fast. ## Meet the Symfony Core Team at the API Platform Conference 2026! DevFeed: [Meet the Symfony Core Team at the API Platform Conference 2026!]() Original publisher: [Read original article]() Author: Cécile HAMEREL Published: 2026-09-02T14:30:00Z Content type: news Language: en Sources: [Symfony Blog]() Topics: [API](), [Symfony](), [PHP](), [migration](), [Domain-driven design (DDD)](), [JSON Web Tokens](), [OAuth 2.0](), [OpenID connect (OIDC)](), [Model Context Protocol (MCP)]() Tags: [2026](), [ai-agents](), [api-platform](), [conference](), [event](), [mcp](), [migration](), [oauth2](), [oidc](), [php](), [symfony]() ### AI overview The API Platform Conference 2026 will take place in Lille, France, on September 17-18. The event will feature nearly 30 talks, including sessions by Symfony Core Team members on migration, API security, DDD, HTTP headers, FrankenPHP, AI agents, and MCP. ### Source excerpt The API Platform Conference, the international event dedicated to the API Platform framework and its ecosystem, will take place in two weeks in Lille, France, on September 17-18, 2026. Nearly 30 talks are scheduled, in both French and English, covering... ## OpenID Connect Authentication for MySQL, Now Fully Open Source DevFeed: [OpenID Connect Authentication for MySQL, Now Fully Open Source]() Original publisher: [Read original article]() Author: Michał Jankowski Published: 2026-09-02T08:56:26Z Content type: article Language: en Sources: [Blog - Percona]() Topics: [MySQL](), [OpenID connect (OIDC)](), [Authentication](), [JSON Web Tokens](), [OAuth](), [Open Source]() Tags: [authentication](), [jwks](), [jwt](), [mysql](), [oauth](), [oauth-2-0](), [oidc](), [open-source](), [openid-connect](), [percona](), [percona-server-for-mysql](), [percona-software](), [security]() ### AI overview Percona Server for MySQL includes an open-source OpenID Connect authentication plugin for specified 8.4 and 9.7 releases. The article explains how it authenticates users through standards-compliant identity providers and describes capabilities beyond the MySQL Enterprise plugin, including JWKS signing-key synchronization, group-to-role mapping, and proxy-user support. ### Source excerpt Percona Server for MySQL now ships with a fully open source OpenID Connect (OIDC) authentication plugin, available starting with Percona Server for MySQL 8.4.11-11 and 9.7.2-2 (not yet released as of this writing). It allows a MySQL account to authenticate against any standards-compliant Identity Provider (IdP) instead of relying on a locally stored password, closing ... Continued The post OpenID Connect Authentication for MySQL, Now Fully Open Source appeared first on Percona. ## Your app is the other half of agent SSO DevFeed: [Your app is the other half of agent SSO]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-31T20:22:53Z Content type: opinion Language: en Sources: [WorkOS Blog]() Topics: [Single sign-on (SSO)](), [Authorization](), [JSON Web Tokens](), [OAuth 2.0](), [computer-use]() Tags: [ai-agents](), [app](), [authorization](), [jwt](), [oauth-2-0](), [security](), [sso]() ### AI overview This commentary explains that Okta's Agent SSO and the Cross App Access standard broker connections between AI agents and enterprise applications, but the connected application remains responsible for validating the grant and issuing its own access token. It describes the resource-side roles and the underlying OAuth and JWT-based standards. ### Source excerpt Okta's Agent SSO went GA on the Cross App Access standard. The IdP brokers the connection, but your app still has to validate the grant and issue the token. ## Keycloak 26.7.3 released DevFeed: [Keycloak 26.7.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-31T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [JSON Web Tokens](), [LDAP](), [reCAPTCHA]() Tags: [2026](), [cve](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [microsoft](), [oidc](), [openid-connect](), [recaptcha](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.3 was released on August 31, 2026. The release includes security fixes addressing LDAP certificate verification, signed-JWT assertion policies, authorization controls, information disclosure, token exchange restrictions, OIDC response-parameter injection, and related issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #50785 CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap #50997 [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc #50998 [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users organizations #51001 [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2 admin/fine-grained-permissions #51002 [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints admin/rbac #51003 [CVE-2026-16089] Authorization codes can be retargeted to another client session oidc #51005 [CVE-2026-16104] Authenticator config surfaces expose raw reCAPTCHA secrets admin/fine-grained-permissions #51112 [CVE-2026-16106] Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles admin/fine-grained-permissions #51142 [CVE-2026-17059] Information disclosure: GET /roles/{role}/users returns user PII without the per-user view filter admin/fine-grained-permissions #51279 [CVE-2026-18218] Client not-before revocation is ignored when realm not-before is older but nonzero oidc #51282 [CVE-2026-18215] Microsoft external access-token exchange bypasses configured tenant token-exchange #51283 [CVE-2026-18201] Generic identity-provider creation can bind brokers to organizations without manage-organizations organizations #51286 [CVE-2026-18209] Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check (commit 18832bca) inspects only the query string, not the URL fragment oidc #51287 [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction token-exchange #5137 ## 【kube-apiserver】Authentication：SA、Bearer、OIDC 边界 DevFeed: [【kube-apiserver】Authentication：SA、Bearer、OIDC 边界]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Authentication](), [Kubernetes](), [OpenID connect (OIDC)](), [JSON Web Tokens](), [authz]() Tags: [api](), [apiserver](), [authentication](), [authorization](), [bearer-token](), [distributed](), [jwt](), [k8s](), [kubernetes](), [oidc](), [serviceaccount](), [v1-30-3]() ### AI overview This Chinese-language tutorial explains the kube-apiserver authentication chain in Kubernetes v1.30.3. It distinguishes X.509 certificates, ServiceAccount tokens, static and bootstrap tokens, OIDC JWTs, webhook authentication, and anonymous requests, and separates authentication failures such as 401 from storage-layer failures such as 503 or 504. ### Source excerpt 钉 K8s v1.30.3 的认证链：X509、SA token（bound token）、Bearer、OIDC、Webhook token、匿名用户；ServiceAccount bound token 与 TokenRequest 语义；apiserver 认证 flags 边界；401 与存储层故障的分列；AuthZ 路径见第 11 篇。 ## Enterprise-managed auth is GA and your MCP server needs a new grant type DevFeed: [Enterprise-managed auth is GA and your MCP server needs a new grant type]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-26T14:14:11Z Content type: release Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol](), [anthropic](), [Authorization](), [JSON Web Tokens](), [Claude](), [OAuth](), [vs-code]() Tags: [anthropic](), [authorization](), [claude](), [claude-code](), [jwt](), [mcp](), [mcp-server](), [oauth](), [vs-code]() ### AI overview Anthropic's enterprise-managed authentication for MCP connectors is generally available. MCP server authorization servers must support JWT bearer grants, omit dynamic client registration, and establish trust for each tenant's issuer. The article also describes adoption across Claude, VS Code, and enterprise identity providers. ### Source excerpt Anthropic's enterprise-managed auth for MCP connectors is now GA. What your authorization server has to support: JWT bearer, no DCR, per-tenant issuer trust. ## Add Cross App Access to Your OIDC Resource Application DevFeed: [Add Cross App Access to Your OIDC Resource Application]() Original publisher: [Read original article]() Author: Sohail Pathan Published: 2026-08-24T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OpenID connect (OIDC)](), [API](), [Authorization](), [JSON Web Tokens](), [Single sign-on (SSO)](), [OAuth 2.0]() Tags: [api](), [authorization](), [cross-app-access](), [jwt](), [oauth-2-0](), [oidc](), [okta](), [scopes](), [sso](), [token](), [xaa]() ### AI overview This guide explains how OIDC-federated applications can support Cross App Access (XAA) for API access on behalf of users. It covers validating and redeeming the ID-JAG, resolving users from claims, issuing access tokens, updating authorization server metadata, and testing the end-to-end flow. ### Source excerpt If you currently federate enterprise customers using OpenID Connect (OIDC) and want to allow applications to access your API on behalf of those users, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your authorization server already trusts the customer's IdP for single sign-on (SSO), and XAA reuses that same trust for API access. This guide details what you need to support, how to validate the grant, and how to resolve the user at your resource authorization server. Table of Contents How XAA in OIDC works Analyzing the ID-JAG claims XAA implementation checklist for OIDC-federated applications Mapping user identity from iss and sub Validating the ID-JAG and resolving the user Issuing the access token Updating authorization server metadata Making cross-application requests from your OIDC app securely Configure your XAA OIDC Resource app in Okta Create the OIDC requesting app for testing Create the OIDC resource app in Okta Register and configure the AI Agent in Okta Verify your Okta XAA setup on xaa.dev Configure OIDC SSO Verify the refresh token exchange for an ID-JAG token Redeem the ID-JAG for an access token at the resource authorization server Call the resource API with the access token Prove the XAA connection end-to-end Takeaways for implementors who also have SAML apps Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the customer's Identity Provider (IdP) for your authorization server. Your resource server accepts the token, identifies the user, and issues your own access token, all while leaving the customer's existing OIDC integration untouched. The sequence diagram shown below describes the OIDC XAA flow. Notice that the OIDC SSO flow stays the ## Add Cross App Access to Your OIDC Requesting Application DevFeed: [Add Cross App Access to Your OIDC Requesting Application]() Original publisher: [Read original article]() Author: Sohail Pathan Published: 2026-08-21T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OpenID connect (OIDC)](), [OAuth](), [OAuth 2.0](), [JSON Web Tokens](), [API](), [Authorization](), [AI Agent]() Tags: [agent](), [api](), [authorization](), [callback](), [claude](), [cross-app-access](), [identity](), [jwt](), [oauth](), [oauth-2-0](), [oidc](), [openid-connect](), [sso](), [third-party-applications](), [token](), [xaa]() ### AI overview This guide explains how an OIDC-federated application can use Cross App Access (XAA) to request resources from a third-party application. It describes exchanging a refresh token for an Identity Assertion Authorization Grant, exchanging that short-lived JWT for an OAuth access token, and using the access token for the resource API request. ### Source excerpt If you currently federate enterprise customers using OpenID Connect (OIDC) and want to connect with third-party applications, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your app already holds an ID token after sign-in, but it's the refresh token from that same sign-in that you exchange to reach a third-party app. This guide details what you need to support and how to make resource requests to a third-party app using XAA. Table of Contents How XAA in OIDC works XAA implementation checklist for OIDC-federated applications Request the ID-JAG token Request the access token Call the resource API Handle token expiration Making cross-application requests from your OIDC app securely Configure your XAA OIDC requesting app in Okta Register the requesting app in Okta Register the test resource app in Okta Register your requesting app at xaa.dev Register and configure the AI Agent in Okta Validate the XAA connection end-to-end Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the Identity Provider (IdP) for your app's user. You exchange the ID-JAG token for an access token to the resource application you're connecting with. The sequence diagram below describes the OIDC XAA flow and how your application fits into it. You'll handle the flow in two parts: where your application requests the ID-JAG from the IdP using the refresh token, and where your app requests the access token from the ID-JAG from the third-party resource app's authorization server. XAA implementation checklist for OIDC-federated applications Follow the guide in this section to support XAA in your OIDC application when your app connects to a third-party resource application. The XAA flow places t ## How to add enterprise SSO to an Express.js API DevFeed: [How to add enterprise SSO to an Express.js API]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-21T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Single sign-on (SSO)](), [Tutorial](), [Express](), [Node.js](), [API](), [JSON Web Tokens](), [OpenID connect (OIDC)](), [Authorization](), [Back end]() Tags: [api](), [authorization](), [how-to](), [js](), [jwt](), [middleware](), [node-js](), [oidc](), [security](), [sso]() ### AI overview A step-by-step tutorial for adding enterprise SSO to an Express.js API with WorkOS. It covers SAML and OIDC login redirects, callback handling, JWT verification on protected routes, and multi-tenant authorization using signed token claims. ### Source excerpt Add enterprise SSO (SAML and OIDC) to an Express.js API with WorkOS. Step-by-step Node.js code for the login redirect, the callback, and JWT verification on protected API routes. ## Okta Cross App Access (XAA / ID-JAG) in Nirmata AIControls: standards-based authorization for AI agents DevFeed: [Okta Cross App Access (XAA / ID-JAG) in Nirmata AIControls: standards-based authorization for AI agents]() Original publisher: [Read original article]() Author: Ritesh Patel Published: 2026-08-19T00:24:40Z Content type: article Language: en Sources: [Nirmata]() Topics: [cross-app-access](), [Authorization](), [okta](), [Artificial Intelligence](), [Model Context Protocol (MCP)](), [Large Language Model](), [JSON Web Tokens](), [OAuth]() Tags: [ai](), [authorization](), [cross-app-access](), [engineering](), [jwt](), [llm](), [mcp](), [mcp-server](), [oauth](), [okta](), [standards]() ### AI overview The article explains how Nirmata AIControls supports Okta Cross App Access and the ID-JAG authorization profile for AI agents. It describes token exchanges performed on behalf of agents, administrator-controlled app-to-app access, policy checks, budgets, and audit records for delegated MCP and LLM calls. ### Source excerpt AIControls now performs the ID-JAG token exchanges on your agents' behalf -- so agents need no protocol code -- and policy-checks, budgets, and attributes every delegated MCP and LLM call to the human it acts for. ID-JAG answers may this agent act for this user? AIControls answers what... The post Okta Cross App Access (XAA / ID-JAG) in Nirmata AIControls: standards-based authorization for AI agents first appeared on Nirmata. ## Implement custom authentication for tools integration using request Lambda interceptor in AgentCore Gateway DevFeed: [Implement custom authentication for tools integration using request Lambda interceptor in AgentCore Gateway]() Original publisher: [Read original article]() Author: Nishant Mainro Published: 2026-08-18T20:46:26Z Content type: tutorial Language: en Sources: [AWS Security Blog]() Topics: [Amazon Bedrock AgentCore](), [Amazon Bedrock](), [AI Agent](), [Security](), [IAM](), [Model Context Protocol](), [OAuth 2.0](), [Architecture & Design](), [JSON Web Tokens]() Tags: [advanced-300](), [ai-agents](), [amazon-bedrock](), [amazon-bedrock-agentcore](), [artificial-intelligence](), [aws-identity-and-access-management-iam](), [aws-lambda](), [model-context-protocol](), [oauth](), [prompt-injection](), [secrets](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview This tutorial explains how to use a request Lambda interceptor in Amazon Bedrock AgentCore Gateway to support legacy Basic Authentication for downstream tool APIs. The interceptor retrieves service credentials from AWS Secrets Manager and constructs the authentication header while keeping credentials isolated from the AI agent. The article also describes the inbound MCP request flow and cautions that Basic Auth should be treated as an interim measure, with modernization toward OAuth 2.0, SAML, OpenID Connect, or IAM recommended. ### Source excerpt When deploying AI agents with Amazon Bedrock AgentCore, organizations benefit from built-in modern support for OAuth 2.0, AWS Identity and Access Management (IAM), and API key authentication through Amazon Bedrock AgentCore Gateway. However, some enterprise environments still use legacy authentication mechanisms such as HTTP Basic Authentication (Basic Auth) (RFC 7617). The extensible architecture of AgentCore [...] ## How to store and refresh session tokens correctly with the WorkOS iOS SDK DevFeed: [How to store and refresh session tokens correctly with the WorkOS iOS SDK]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-18T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [iOS](), [SDK](), [Authentication](), [JSON Web Tokens]() Tags: [apple](), [auth](), [authentication](), [concurrent](), [guide](), [how-to](), [ios](), [jwt](), [native](), [plist](), [rotation](), [sdk](), [storage](), [tokens](), [tutorial]() ### AI overview This tutorial explains how to store and refresh session tokens with the WorkOS iOS SDK. It recommends storing access and refresh tokens in the Keychain, persisting each rotated refresh token, and distinguishing terminal refresh failures from transient network or concurrency-related failures. ### Source excerpt A practical guide to Keychain storage, refresh token rotation, and terminal vs. transient failures on iOS ## Sign JWTs from your Functions without managing private keys DevFeed: [Sign JWTs from your Functions without managing private keys]() Original publisher: [Read original article]() Author: Jeff Pope Published: 2026-08-18T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [JSON Web Tokens](), [OpenID connect (OIDC)](), [JSON Schema](), [Command-line interface](), [dashboards]() Tags: [cli](), [configuration](), [jwks](), [oidc](), [openid-connect](), [rsa](), [tokens](), [vercel]() ### AI overview Vercel KMS enables Vercel Functions to sign JWTs and arbitrary messages with managed asymmetric keys, keeping private keys out of application code and environment variables. It supports issuer and key management, environment-specific access grants, claim constraints, JSON Schema validation, and standard OIDC and JWKS-based verification. ### Source excerpt Vercel KMS lets you sign JWTs and arbitrary messages from your Vercel Functions using managed asymmetric signing keys, so private keys never live in your code or environment variables. Your function authenticates with its Vercel OIDC token, and the private key stays inside Vercel's key management service while verifiers use only the public key. With Vercel KMS you can: Create and rotate issuers and signing keys (RSA, ECDSA, and EdDSA) from the CLI and dashboard. Sign JWTs with custom claims and a configurable TTL, or sign raw bytes, using the @vercel/kms package. Grant a project signing access per environment, including production, preview, development, and custom environments. Constrain the claims a project can request per grant, and validate token claims against a JSON Schema. Verify signed tokens anywhere. Each issuer publishes a public OpenID Connect Discovery document at https://kms.vercel.com//.well-known/openid-configuration and a JWK set at https://kms.vercel.com//jwks.json, so any standard OIDC or JOSE library can validate tokens without Vercel-specific code. Sign a token inside a function: Verify a token anywhere with a standard JOSE library, using the issuer's public JWKS: Set up an issuer and grant a project access from the CLI: As a best practice, create a separate issuer per project and environment. Isolating issuers keeps each token audience distinct, scopes signing access to exactly one project and environment, and lets you rotate or revoke keys for one without affecting the others. To get started, read the docs or open Key Management in your team's dashboard. Read more ## \[webapps\] Duplicati 2.2.0.3 - JWT Signing Key Leak DevFeed: [\[webapps\] Duplicati 2.2.0.3 - JWT Signing Key Leak]() Original publisher: [Read original article]() Author: Gabriel Rodrigues Published: 2026-08-17T00:00:00Z Content type: article Language: en Sources: [Exploit-DB.com RSS Feed]() Topics: [JSON Web Tokens](), [Exploit]() Tags: [exploit](), [jwt](), [leak](), [multiple](), [platform](), [signing](), [webapps]() ### AI overview An exploit listing identifies a JWT signing key leak in Duplicati 2.2.0.3 and describes it as a web application exploit for multiple platforms. ### Source excerpt Duplicati 2.2.0.3 - JWT Signing Key Leak ## Why We Wrote a New JWT Library for Kotlin Multiplatform DevFeed: [Why We Wrote a New JWT Library for Kotlin Multiplatform]() Original publisher: [Read original article]() Published: 2026-08-07T00:00:00Z Content type: article Language: en Sources: [Touchlab | Enterprise Mobile Innovation & Development]() Topics: [JSON Web Tokens](), [Kotlin Multiplatform](), [Cryptography](), [Authentication](), [Authorization](), [Open Source](), [Library]() Tags: [authentication](), [authorization](), [community](), [cryptography](), [jwt](), [kmp](), [kotlin](), [kotlin-multiplatform](), [libraries](), [library](), [open-source]() ### AI overview The author explains how a security-focused Kotlin Multiplatform banking project led to research into cryptography and JWTs. After finding that JJWT was limited for cross-platform projects, they began developing a new JWT library as a personal open-source learning project. ### Source excerpt Earlier this year, we silently started working on and published a new KMP library. The reason it exists serves as a good lesson on how to start contributing to the open-source community. ## Why stateless JWT logout is not immediate and how to revoke access DevFeed: [Why stateless JWT logout is not immediate and how to revoke access]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-06T01:36:54Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [JSON Web Tokens](), [Security](), [Architecture & Design]() Tags: [jwt](), [public-key](), [rotation](), [security](), [stateless](), [token](), [verification]() ### AI overview The article explains that signed stateless JWTs remain valid until expiration, so logging out or deactivating a user cannot revoke an already-issued token immediately. It compares short-lived access tokens with refresh-token rotation against a server-side denylist as approaches to revocation. ### Source excerpt Stateless JWTs stay valid until they expire, so logout isn't instant. Here's why enterprise SCIM makes that a compliance problem -- and how to really fix it. [Next page]()