# OAuth OAuth is an open standard for authorization on the web. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How to study for the MCPA security and governance domain DevFeed: [How to study for the MCPA security and governance domain]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-16T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol](), [Security](), [Authorization](), [OAuth]() Tags: [agent](), [agentic](), [audit](), [authorization](), [model-context-protocol](), [oauth](), [security]() ### AI overview A study guide for the security and governance domain of the Model Context Protocol Associate exam. It explains trust boundaries, token audience validation, token handling between MCP servers and upstream APIs, and the distinction between consent and authorization. ### Source excerpt Security and governance is 24% of the new Model Context Protocol Associate exam. Here is what each competency actually covers in the 2026-07-28 spec, and the distinctions candidates get wrong. ## Laravel MCP 1.0 Is Released DevFeed: [Laravel MCP 1.0 Is Released]() Original publisher: [Read original article]() Author: Eric L. Barnes Published: 2026-09-15T14:27:51Z Content type: release Language: en Sources: [Laravel]() Topics: [Laravel](), [Model Context Protocol (MCP)](), [OAuth](), [pkce](), [Caching](), [servers]() Tags: [caching](), [context-window](), [laravel](), [mcp](), [news](), [oauth](), [pkce](), [servers]() ### AI overview Laravel MCP 1.0 is the first stable release of Laravel's package for building Model Context Protocol servers. It adds protocol revision 2026-07-28 support, searchable tool catalogs, cache hints, stateless request handling, OAuth changes requiring PKCE, and Client ID Metadata Documents. ### Source excerpt Laravel MCP 1.0 ships protocol revision 2026-07-28, stateless servers, searchable tool catalogs, cache hints, and reworked OAuth with required PKCE. The post Laravel MCP 1.0 Is Released appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox. ## AI SDK harness layer now supports native subscription authentication DevFeed: [AI SDK harness layer now supports native subscription authentication]() Original publisher: [Read original article]() Author: Felix Arntz Published: 2026-09-14T21:28:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [vercel ai sdk](), [Authentication](), [OAuth](), [codex](), [Claude Code]() Tags: [ai](), [authentication](), [claude-code](), [codex](), [coding-agents](), [copilot](), [cursor](), [gateway](), [oauth](), [opencode](), [sdk]() ### AI overview The AI SDK harness layer now supports authenticating supported coding-agent harnesses through their native subscriptions. It uses explicit provider credentials when available, otherwise falls back to a host-native subscription without requiring code or configuration changes. ### Source excerpt The AI SDK harness layer now supports authenticating harnesses through their native subscriptions, where the underlying harness supports them. The harness layer runs different coding agents through the same HarnessAgent interface, so you can switch agents without changing your application code. No code changes or new settings are required. The direct authentication mode uses explicit provider environment credentials when they are present, and otherwise a native subscription found on the host. The default auto mode does the same when no AI Gateway credentials are set. The ai-gateway mode never reads native subscriptions. Native subscription credentials stay on the host. Just like with API keys, credentials are resolved at the host boundary. OAuth access tokens are refreshed there as needed. Where the sandbox supports it, the harness receives placeholder credentials and the real token is injected into outbound requests on the host. Native subscriptions work across harness adapters wherever the harness itself supports subscription login. These include Claude Code, Cline, Codex, Cursor, fx, GitHub Copilot, Grok Build, OpenCode, and Pi. Read the harness documentation to learn more. Read more ## Manage end-user OAuth consent for AI agents with Amazon Bedrock AgentCore DevFeed: [Manage end-user OAuth consent for AI agents with Amazon Bedrock AgentCore]() Original publisher: [Read original article]() Author: Swara Gandhi Published: 2026-09-14T20:35:45Z Content type: tutorial Language: en Sources: [Artificial Intelligence]() Topics: [Amazon Bedrock AgentCore](), [OAuth](), [Amazon Web Services](), [AWS CloudTrail](), [GitHub](), [Slack](), [Model Context Protocol](), [ide]() Tags: [amazon-bedrock](), [amazon-bedrock-agentcore](), [announcements](), [aws](), [aws-cloudtrail](), [claude-code](), [cursor](), [github](), [intermediate-200](), [kiro](), [model-context-protocol](), [oauth](), [slack](), [visual-studio-code]() ### AI overview This tutorial explains how Amazon Bedrock AgentCore Identity's Consent portal manages end-user OAuth consent and session binding for AI agents. It covers configuring GitHub and Slack targets through an AgentCore Gateway, storing user tokens, supporting IDE and MCP clients, and reviewing activity in AWS CloudTrail. ### Source excerpt Amazon Bedrock AgentCore Identity now offers a Consent portal, a managed web experience and session binding endpoint for AgentCore Gateway. This post walks through provisioning a portal, configuring GitHub and Slack 3LO targets, and the end-user consent flow, and shows how to review activity in AWS CloudTrail. ## Adding Google Login to a React App with Auth0 DevFeed: [Adding Google Login to a React App with Auth0]() Original publisher: [Read original article]() Author: Carla Urrea Stabile Published: 2026-09-11T00:00:00Z Content type: tutorial Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [React](), [SDK](), [OAuth](), [OpenID connect (OIDC)](), [Vite](), [web applications](), [Node.js]() Tags: [auth0](), [authentication](), [google](), [node-js](), [oauth](), [oidc](), [react](), [sdk](), [tutorial](), [vite](), [web-applications]() ### AI overview A step-by-step tutorial for adding Google login to a Vite-based React application with Auth0. It covers installing the Auth0 React SDK, creating and configuring an Auth0 application, setting callback, logout, and web-origin URLs, and preparing credentials for production Google authentication. ### Source excerpt Add Google login to a React app with Auth0. A step-by-step tutorial from installing the Auth0 React SDK to configuring your own production Google credentials. ## OIDC is a standard, identity providers are not DevFeed: [OIDC is a standard, identity providers are not]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-09T16:09:50Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [OpenID connect (OIDC)](), [interoperability](), [OAuth](), [JSON Web Tokens](), [Authentication]() Tags: [compatibility](), [interoperability](), [jwt](), [oauth](), [oidc](), [providers]() ### AI overview This article explains why generic OpenID Connect integrations often require provider-specific compatibility settings. It discusses differences in token-endpoint client authentication, including client secret basic, client secret POST, and private key JWT. ### Source excerpt Generic OIDC connections meet identity providers that read the same spec differently. Here are the per-connection compatibility settings we added, and why. ## Inside the ID-JAG: How enterprise-managed authorization actually works DevFeed: [Inside the ID-JAG: How enterprise-managed authorization actually works]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [Model Context Protocol](), [JSON Web Tokens](), [OAuth]() Tags: [authorization](), [enterprise](), [jwt](), [mcp](), [mcp-server](), [oauth]() ### AI overview This tutorial explains how the Enterprise-Managed Authorization extension to MCP uses ID-JAGs--short-lived, signed JWT authorization grants--to let an identity provider authorize a client to access an MCP resource server. The authorization server exchanges the ID-JAG for an access token, replacing repeated user consent screens with centrally managed enterprise authorization. The article notes that the ID-JAG draft remains an active IETF document even though the MCP extension is marked Stable. ### Source excerpt The consent screen is no longer where access gets decided. Here is what replaced it, and what your MCP server now has to validate. ## Announcing Appwrite Apps: Create apps that build on your users' Appwrite projects DevFeed: [Announcing Appwrite Apps: Create apps that build on your users' Appwrite projects]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-09-04T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [OAuth](), [OAuth 2.0](), [API keys](), [Authorization](), [API](), [migration]() Tags: [announcements](), [api-keys](), [apis](), [authorization](), [developers](), [documentation](), [oauth](), [oauth2](), [product]() ### AI overview Appwrite announces Appwrite Apps, allowing organizations to register applications that serve other Appwrite developers. The feature uses OAuth 2.1 and OpenID Connect for consent-based, scoped access to selected projects and organizations instead of pasted API keys. ### Source excerpt Register an app in your organization and build dashboards, deployment tools, CLIs, and agents for other Appwrite developers, with consent-based, scoped tokens instead of pasted API keys. ## What is MCP authorization? How OAuth works for AI agents DevFeed: [What is MCP authorization? How OAuth works for AI agents]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-03T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol (MCP)](), [OAuth](), [MCP Server](), [AI Agent](), [Authorization](), [Authentication]() Tags: [agents](), [authentication](), [authorization](), [discovery](), [mcp](), [oauth](), [scopes](), [token]() ### AI overview This tutorial explains MCP authorization as an OAuth 2.1 flow for allowing AI agents to call protected MCP servers on a user's behalf. It covers the roles of the MCP server, client, and authorization server; audience-bound tokens; discovery; deprecated Dynamic Client Registration; and step-up authorization for additional scopes. ### Source excerpt MCP authorization is the OAuth 2.1 flow that lets an AI agent call a protected MCP server on a user's behalf. Here is how it works, step by step, under the 2026-07-28 spec. ## OpenID Connect Authentication for MySQL, Now Fully Open Source DevFeed: [OpenID Connect Authentication for MySQL, Now Fully Open Source]() Original publisher: [Read original article]() Author: Michał Jankowski Published: 2026-09-02T08:56:26Z Content type: article Language: en Sources: [Blog - Percona]() Topics: [MySQL](), [OpenID connect (OIDC)](), [Authentication](), [JSON Web Tokens](), [OAuth](), [Open Source]() Tags: [authentication](), [jwks](), [jwt](), [mysql](), [oauth](), [oauth-2-0](), [oidc](), [open-source](), [openid-connect](), [percona](), [percona-server-for-mysql](), [percona-software](), [security]() ### AI overview Percona Server for MySQL includes an open-source OpenID Connect authentication plugin for specified 8.4 and 9.7 releases. The article explains how it authenticates users through standards-compliant identity providers and describes capabilities beyond the MySQL Enterprise plugin, including JWKS signing-key synchronization, group-to-role mapping, and proxy-user support. ### Source excerpt Percona Server for MySQL now ships with a fully open source OpenID Connect (OIDC) authentication plugin, available starting with Percona Server for MySQL 8.4.11-11 and 9.7.2-2 (not yet released as of this writing). It allows a MySQL account to authenticate against any standards-compliant Identity Provider (IdP) instead of relying on a locally stored password, closing ... Continued The post OpenID Connect Authentication for MySQL, Now Fully Open Source appeared first on Percona. ## Auth0 launches Early Access for enterprise-managed authorization in client apps DevFeed: [Auth0 launches Early Access for enterprise-managed authorization in client apps]() Original publisher: [Read original article]() Author: Mira Sharma Published: 2026-09-01T00:00:00Z Content type: release Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [Authorization](), [AI Agent](), [Model Context Protocol](), [OAuth](), [Single sign-on (SSO)]() Tags: [ai](), [ai-agent](), [authentication](), [enterprise](), [identity](), [mcp](), [model-context-protocol](), [oauth](), [release](), [saas](), [security](), [sso]() ### AI overview Auth0 announces Early Access for Client App capabilities that implement enterprise-managed authorization through Cross App Access and the ID-JAG draft specification. The feature lets an application or AI agent request access to external APIs or MCP servers using an employee's existing corporate SSO trust, reducing custom token-exchange work and supporting centralized governance. ### Source excerpt Implement Enterprise-Managed Authorization in Auth0 using Cross App Access (XAA) and ID-JAG. Build enterprise-ready AI agents without friction. ## Refresh token behavior across fourteen providers DevFeed: [Refresh token behavior across fourteen providers]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-31T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [OAuth](), [API]() Tags: [providers](), [retry](), [rotation](), [token](), [tokens]() ### AI overview This article compares documented OAuth refresh-token behavior across fourteen providers, including token rotation, expiration reporting, grace periods, and revocation on reuse. It explains how rotation affects persistence and retry handling, with examples including Google, Box, Atlassian, Dropbox, Asana, GitHub, and Salesforce. ### Source excerpt Which providers rotate refresh tokens, which return expires_in, which give you a grace period, and which revoke on reuse. One row per provider, verified against provider documentation in August 2026. ## OAuth token refresh has a race condition. Fix it with a conditional write, not a distributed lock. DevFeed: [OAuth token refresh has a race condition. Fix it with a conditional write, not a distributed lock.]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-31T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [OAuth](), [race-condition](), [Authorization](), [Auth0](), [Redis]() Tags: [auth0](), [authorization](), [concurrent](), [oauth](), [race-condition](), [redis](), [the-result]() ### AI overview This article explains how concurrent OAuth token refreshes can cause two distinct failures: stale tokens from lost updates and user disconnection when refresh-token rotation treats concurrent reuse as replay. It recommends layered defenses, including conditional writes, and explains why a Redis lock does not address both problems. ### Source excerpt Concurrent refreshes don't just fail. They can disconnect the user entirely. Here are four layers of defense, cheapest first, and why the Redis lock everyone reaches for isn't the one keeping you safe. ## Announcing Appwrite 2.0: a new foundation for your apps DevFeed: [Announcing Appwrite 2.0: a new foundation for your apps]() Original publisher: [Read original article]() Author: Eldad Fux Published: 2026-08-31T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Databases](), [Amazon S3](), [OAuth](), [Firewall](), [MySQL](), [PostgreSQL]() Tags: [feature](), [firewall](), [mysql](), [oauth](), [postgresql](), [products](), [release](), [s3]() ### AI overview Appwrite 2.0 is a major platform release with a new engine, rebuilt Console, relational, schemaless, and vector data support, native PostgreSQL and MySQL engines, S3-addressable storage, OAuth 2.1 and OpenID Connect support, and organization-level Domains and Firewall. ### Source excerpt Appwrite 2.0 brings a new engine, a rebuilt Console, five database types, an S3 API, an OAuth 2.1 server, and organization-level Domains and Firewall. ## How to Add Custom Providers to WorkOS Pipes DevFeed: [How to Add Custom Providers to WorkOS Pipes]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-28T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [OAuth](), [API keys](), [API](), [dashboards](), [Back end]() Tags: [api](), [api-keys](), [backend](), [integration](), [oauth](), [widget]() ### AI overview This tutorial explains how to add custom providers to WorkOS Pipes when a provider is not in the catalog. It covers custom credentials, organization-scoped providers, and custom provider configuration for OAuth or API-key-based integrations, while preserving the existing connection-consuming code. ### Source excerpt The path for adding a provider yourself, whether it speaks OAuth, odd OAuth, or only API keys. ## WorkOS Pipes: Where your users' tokens actually live DevFeed: [WorkOS Pipes: Where your users' tokens actually live]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-28T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Encryption](), [Security](), [OAuth](), [pkce](), [API](), [migration]() Tags: [api](), [encryption](), [migration](), [oauth](), [organization](), [pkce](), [security]() ### AI overview This article explains how WorkOS Pipes stores and protects users' OAuth and other connection credentials. It distinguishes connection metadata from credential values, describes scoped access and AES-256 encryption at rest, covers PKCE support and security posture, and discusses migrating existing tokens and the validation risks of updates. ### Source excerpt A walk through the Pipes credential vault: envelope encryption, key context, what a compromised key reaches, and how key rotation happens without re-consent. ## Three ways to let an AI agent call third-party APIs on behalf of a user DevFeed: [Three ways to let an AI agent call third-party APIs on behalf of a user]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-27T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [AI Agent](), [OAuth](), [Security]() Tags: [agent](), [ai-agent](), [apis](), [hubspot](), [linear](), [oauth](), [patterns](), [proxy](), [security](), [slack](), [third-party](), [tokens]() ### AI overview This article explains three patterns for letting an AI agent access third-party APIs on a user's behalf: storing OAuth credentials yourself, fetching tokens at runtime, or using a proxy that keeps tokens out of the agent-controlled runtime. It compares their operational and security implications and recommends choosing based on where the code runs and the system's requirements. ### Source excerpt Store the token yourself, fetch it at runtime, or never hold it at all. Where the credential ends up in each pattern, what each one costs, and how to pick without guessing. ## Multi-tenant OAuth requires credential lifecycle management beyond token isolation DevFeed: [Multi-tenant OAuth requires credential lifecycle management beyond token isolation]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-27T00:00:00Z Content type: opinion Language: en Sources: [WorkOS Blog]() Topics: [OAuth](), [Encryption](), [Authorization]() Tags: [architecture](), [encryption](), [iam](), [lifecycle](), [oauth](), [rotation](), [storage](), [vault]() ### AI overview The article argues that token isolation and storage architecture are only the starting point for multi-tenant OAuth. The harder, ongoing problems include refresh races, key rotation, provider-wide revocations, token expiration, and external revocations without webhooks. It also explains how envelope encryption and per-tenant key contexts can support bridge-style isolation. ### Source excerpt Storage architecture is the half you can finish. The refresh loop, key rotation, and revocation are the half that never does. ## What shipping an OAuth app on Slack, Microsoft, and Atlassian actually takes DevFeed: [What shipping an OAuth app on Slack, Microsoft, and Atlassian actually takes]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-27T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [OAuth](), [atlassian](), [Microsoft](), [Slack]() Tags: [apps](), [atlassian](), [distribution](), [integration](), [launch](), [microsoft](), [oauth](), [review](), [slack]() ### AI overview This article explains the non-code requirements for launching an OAuth app on Slack, Microsoft, and Atlassian. It highlights Slack's requirement for five active-workspace installs before Marketplace submission, Microsoft's partner-account requirement, Atlassian's identity-verification requirement, and the uncertainty of provider review queues. ### Source excerpt Five installs before Slack reads your submission, a partner account before Microsoft trusts your consent screen, and identity verification before Atlassian lists you. None of it is code. ## Enterprise-managed auth is GA and your MCP server needs a new grant type DevFeed: [Enterprise-managed auth is GA and your MCP server needs a new grant type]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-26T14:14:11Z Content type: release Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol](), [anthropic](), [Authorization](), [JSON Web Tokens](), [Claude](), [OAuth](), [vs-code]() Tags: [anthropic](), [authorization](), [claude](), [claude-code](), [jwt](), [mcp](), [mcp-server](), [oauth](), [vs-code]() ### AI overview Anthropic's enterprise-managed authentication for MCP connectors is generally available. MCP server authorization servers must support JWT bearer grants, omit dynamic client registration, and establish trust for each tenant's issuer. The article also describes adoption across Claude, VS Code, and enterprise identity providers. ### Source excerpt Anthropic's enterprise-managed auth for MCP connectors is now GA. What your authorization server has to support: JWT bearer, no DCR, per-tenant issuer trust. ## Build an Authenticated Standalone Angular v22 App with the Okta Angular SDK DevFeed: [Build an Authenticated Standalone Angular v22 App with the Okta Angular SDK]() Original publisher: [Read original article]() Author: Alisa Duncan Published: 2026-08-25T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [Angular](), [Authentication](), [OpenID connect (OIDC)](), [Angular CLI](), [OAuth](), [SDKs](), [Node.js]() Tags: [angular](), [angular-v22](), [authentication](), [cli](), [node-js](), [oauth](), [oidc](), [release](), [sdk](), [tutorial]() ### AI overview This tutorial updates a small Angular v22 application to use the standalone Okta Angular SDK. It covers adding authentication with the provider function, protecting routes with functional guards, loading user groups with rxResource and signal inputs, and moving Okta configuration to runtime loading. ### Source excerpt Have you noticed that the Okta Angular SDK went fully standalone? There's no NgModule left to import, no importProvidersFrom wrapper to remember, and the guards are plain functions now. If you've been waiting for the SDK to look like the rest of your standalone Angular app, this is the release you were waiting for. In this post, we'll pick up a small Angular v22 project and finish it. We'll make the following changes: Add authentication using the new provideOktaAuth provider function Protect a route with the SDK's functional guard Load each user's groups with rxResource and a signal input Move the Okta configuration to runtime loading We're calling Okta's APIs directly for this project, so we don't have to stand up a separate backend. If you want to jump to the completed project, you can find it in the okta-angular-auth-signals-example GitHub repository. Otherwise, warm up your fingers and let's get coding! Note This post is best for developers familiar with Angular. If you are an Angular newbie, start by building your first Angular app using the tutorial created by the Angular team. Prerequisites For this tutorial, you will need the following tools: Node.js v22 or greater Angular CLI An Okta Integrator Free Plan account A web browser with good debugging capabilities Your favorite IDE Terminal window (if you aren't using an IDE with a built-in terminal) Table of Contents Get the starting Angular project Secure the Angular app with OAuth 2.1 and OpenID Connect (OIDC) using Okta Grant API scopes to read users and groups Allow cross-origin requests and protect the access token Add authentication with the standalone Okta Angular provider Protect routes with functional route guards Add users to your Okta org Display users and review Angular's rxResource API Load a user's groups with rxResource and a signal input Display group details using signal inputs Load your Okta configuration at runtime Learn more about Angular signals, standalone APIs, and OIDC Get the starting An ## The end of credential sprawl for agents DevFeed: [The end of credential sprawl for agents]() Original publisher: [Read original article]() Author: Dima Voytenko Published: 2026-08-25T04:00:00Z Content type: article Language: en Sources: [Vercel News]() Topics: [Vercel](), [Security](), [OAuth](), [OpenID connect (OIDC)](), [Authorization](), [SDKs](), [API](), [pull-requests]() Tags: [agents](), [connectors](), [github](), [oidc](), [pull-requests](), [sdk](), [security](), [shopify]() ### AI overview Vercel Connect is generally available as a way for applications and agents to obtain short-lived, task-scoped credentials at runtime. It supports connectors for services such as Slack, GitHub, Snowflake, Shopify, and OAuth providers, uses deployment OIDC identity for authentication, refreshes tokens automatically, and avoids storing provider secrets in applications. ### Source excerpt Every useful agent reaches beyond your codebase. It posts to Slack, opens pull requests, queries Snowflake, or calls an internal API. That reach is what makes it valuable, and it's also where the risk lives, because for years, granting it meant provisioning a long-lived token and hoping it never leaked. Vercel Connect replaces long-lived tokens with ones your code requests at runtime, scoped to the task and expiring on their own. During the public beta, we've grown the ecosystem past 100 connectors, unified how they work, and added the governance capabilities teams need in production. Today, Vercel Connect is generally available. Vaults don't fix long-lived tokens Managing credentials has become its own workload. Teams write rotation scripts, copy secrets across environments, and share tokens between users. Putting a token in a vault made it harder to steal, but no less dangerous once stolen. It never expires, and no vault limits what a leaked credential can do. Agents compounded the problem by touching more systems with greater autonomy, more often. Yet the tools to contain a secret haven't changed. With Vercel Connect, your app never stores credentials. It requests one: You register a connector once for a provider like Slack, GitHub, Snowflake, Shopify, or your own OAuth service You attach it to the projects and environments that need it Your code requests a token at runtime, and it refreshes automatically Your app has no provider secret to commit by accident Requesting a token doesn't require another secret. Every deployment on Vercel carries an OIDC identity, and the SDK uses it to prove who's asking. What changes when access becomes a request The difference shows up in the properties of the credential: Property Stored token Vercel Connect Lifetime Never expires Short-lived, refreshed automatically Reach Everything the agent could need Scoped to the task in the request Identity One shared bot for every user App or a specific named user Rotation Mint, update copi ## Running your own OAuth and OIDC provider in 2026 is an operations problem DevFeed: [Running your own OAuth and OIDC provider in 2026 is an operations problem]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-25T00:00:00Z Content type: opinion Language: en Sources: [WorkOS Blog]() Topics: [OAuth](), [OpenID connect (OIDC)](), [Authorization](), [Security]() Tags: [oauth](), [oidc](), [operations](), [security](), [upgrade]() ### AI overview The article argues that operating a self-hosted OAuth and OIDC provider in 2026 is primarily an operations challenge. Using Better Auth 1.7 as evidence, it highlights key rotation, revocation, directory lifecycle, uptime, security maintenance, and migration work alongside protocol features such as DPoP and back-channel logout. ### Source excerpt Better Auth 1.7 shipped DPoP, back-channel logout, and MCP alignment. Its own upgrade guide shows why the operational half of an OAuth provider costs more. ## Add Cross App Access to Your OIDC Requesting Application DevFeed: [Add Cross App Access to Your OIDC Requesting Application]() Original publisher: [Read original article]() Author: Sohail Pathan Published: 2026-08-21T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OpenID connect (OIDC)](), [OAuth](), [OAuth 2.0](), [JSON Web Tokens](), [API](), [Authorization](), [AI Agent]() Tags: [agent](), [api](), [authorization](), [callback](), [claude](), [cross-app-access](), [identity](), [jwt](), [oauth](), [oauth-2-0](), [oidc](), [openid-connect](), [sso](), [third-party-applications](), [token](), [xaa]() ### AI overview This guide explains how an OIDC-federated application can use Cross App Access (XAA) to request resources from a third-party application. It describes exchanging a refresh token for an Identity Assertion Authorization Grant, exchanging that short-lived JWT for an OAuth access token, and using the access token for the resource API request. ### Source excerpt If you currently federate enterprise customers using OpenID Connect (OIDC) and want to connect with third-party applications, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your app already holds an ID token after sign-in, but it's the refresh token from that same sign-in that you exchange to reach a third-party app. This guide details what you need to support and how to make resource requests to a third-party app using XAA. Table of Contents How XAA in OIDC works XAA implementation checklist for OIDC-federated applications Request the ID-JAG token Request the access token Call the resource API Handle token expiration Making cross-application requests from your OIDC app securely Configure your XAA OIDC requesting app in Okta Register the requesting app in Okta Register the test resource app in Okta Register your requesting app at xaa.dev Register and configure the AI Agent in Okta Validate the XAA connection end-to-end Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the Identity Provider (IdP) for your app's user. You exchange the ID-JAG token for an access token to the resource application you're connecting with. The sequence diagram below describes the OIDC XAA flow and how your application fits into it. You'll handle the flow in two parts: where your application requests the ID-JAG from the IdP using the refresh token, and where your app requests the access token from the ID-JAG from the third-party resource app's authorization server. XAA implementation checklist for OIDC-federated applications Follow the guide in this section to support XAA in your OIDC application when your app connects to a third-party resource application. The XAA flow places t [Next page]()