# OAuth 2.0 OAuth 2.0 is an industry-standard authorization protocol for web, desktop, mobile, and living-room-device applications. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Appwrite Init 2026 recap: Everything we shipped DevFeed: [Appwrite Init 2026 recap: Everything we shipped]() Original publisher: [Read original article]() Author: Aishwari Pahwa Published: 2026-09-15T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [releases](), [PostgreSQL](), [Amazon S3](), [Firewall](), [OAuth 2.0](), [Self-hosted]() Tags: [2](), [firewall](), [init](), [oauth2](), [postgresql](), [recap](), [release](), [releases](), [s3](), [self-hosted]() ### AI overview An Appwrite Init 2026 recap covering five days of launches, including Appwrite 2.0, a redesigned Console, native PostgreSQL, VectorsDB, DocumentsDB, MySQL, S3-compatible Storage, Firewall, OAuth2, and Domains. ### Source excerpt An Appwrite Init 2026 recap of all five days of launches, from Appwrite 2.0 and native PostgreSQL to VectorsDB, S3 support, Firewall, OAuth2, and Domains. ## This Week in Spring - September 15th, 2026 DevFeed: [This Week in Spring - September 15th, 2026]() Original publisher: [Read original article]() Author: joshlong Published: 2026-09-15T00:00:00Z Content type: article Language: en Sources: [Spring]() Topics: [Spring AI](), [Java](), [Security](), [OAuth 2.0](), [Spring Boot](), [JavaFX](), [IntelliJ IDEA](), [debugging]() Tags: [batch](), [boot](), [cloud](), [debugging](), [event-driven](), [intellij-idea](), [java](), [learn](), [microservices](), [oauth-2-0](), [reactive](), [security](), [serverless](), [spring](), [spring-ai](), [web-applications]() ### AI overview A September 15, 2026 roundup of Spring-related developer content, covering Java memory management, Spring AI chat-memory summarization, JavaFX application security with Spring Security and OAuth 2.0, OAuth 2.1 with Spring Authorization Server, Spring and Gemini video understanding, Java AI libraries, Netflix's Java and Spring story, Spring Batch, and Spring Boot debugging. ### Source excerpt Hi, Spring fans! Welcome to another rip-roarin' installment of This Week in Spring! I'm writing this to you from sun-kissed San Francisco, CA, sipping some coffee and watching the bay from my breakfast nook. What a wonderful day! A wonderful day in which to learn about the latest and greatest in Spring, even! Let's dive right in! I really loved this presentation by Oracle's Ron Pressler on the principles of memory management in Java More Craig Walls Spring AI goodness! Here's a nice recipe on summarizing chat memory Over the last few weeks, I've done some content on securing JavaFX applications with Spring Security and OAuth 2.0. That work has landed, and our friends at JFX-central.com have taken that video and the resulting code and transcribed the content into this lovely tutorial - check it out! I loved this post on securing modern applications with OAuth 2.1 and Spring Authorization Server This is a really cool video on understanding video with Spring and Gemini I just learned about this amazing new Java library called Quixotic.ai (what a name! LOL) that provides all sorts of cool stuff that might make your Java-based AI workloads even better. I wonder if there are amazing integration possibilities for Spring AI, too... In last week's A Bootiful Podcast, I was delighted to sit down and chat with Netflix's Paul Bakker on their Java and Spring story, scaling the system, and more. Huh! There's a new Spring Batch IntelliJ IDEA plugin, but search me for what's new! No release notes. Either way, get it while it's hot! Speaking of Spring Batch, there's a nice post here on scaling to millions of rows with Spring Batch that just dropped Speaking of Spring and IntelliJ, there's a nice article over on Baeldung on debugging Spring Boot-based workloads with the Spring debugger ## A Week of Symfony #1028 (September 7-13, 2026) DevFeed: [A Week of Symfony #1028 (September 7-13, 2026)]() Original publisher: [Read original article]() Author: Javier Eguiluz Published: 2026-09-13T07:05:00Z Content type: news Language: en Sources: [Symfony Blog]() Topics: [Code](), [OAuth 2.0](), [OpenID connect (OIDC)](), [Security]() Tags: [cache](), [code](), [development](), [docs](), [http](), [pull-requests](), [security](), [symfony]() ### AI overview Symfony's weekly roundup covers standalone framework bundles, Docker-style console subcommands, expanded OAuth2 and OpenID Connect support, and SymfonyCon Warsaw 2026 announcements. It also reports merged pull requests, closed issues, and selected development fixes. ### Source excerpt This week, Symfony introduced standalone bundles for the framework features (MessengerBundle, HttpClientBundle, PropertyInfoBundle, etc.), added Docker-style console subcommands, and expanded OAuth2 and OpenID Connect support. In addition, we announced the... ## Turn your app into an MCP server with the Appwrite OAuth2 server DevFeed: [Turn your app into an MCP server with the Appwrite OAuth2 server]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-09-04T00:00:00Z Content type: tutorial Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Model Context Protocol](), [OAuth 2.0](), [Authorization](), [Claude Code](), [Serverless](), [web applications](), [Databases]() Tags: [ai](), [ai-tools](), [app](), [auth](), [authorization](), [browser](), [claude](), [claude-code](), [code](), [databases](), [http](), [mcp](), [mcp-server](), [oauth2](), [remote-mcp-server](), [serverless](), [tutorial](), [tutorials](), [web](), [web-app]() ### AI overview This tutorial explains how to turn an Appwrite-based application into a remote MCP server. It uses an Appwrite Function, the OAuth2 server included in an Appwrite project, and a consent screen so AI tools such as Claude Code can access and act on behalf of signed-in users. ### Source excerpt Build a remote MCP server for your product, host it on Appwrite Functions, and let AI tools like Claude Code sign in through the OAuth2 server built into your Appwrite project. ## Build a memory MCP server on Appwrite DevFeed: [Build a memory MCP server on Appwrite]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-09-04T00:00:00Z Content type: tutorial Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Model Context Protocol](), [MCP Server](), [OAuth 2.0](), [Serverless](), [Databases](), [Embeddings](), [Claude Code](), [web applications]() Tags: [ai](), [ai-assistants](), [ai-tools](), [api](), [claude](), [claude-code](), [embeddings](), [mcp](), [mcp-server](), [memory](), [net](), [oauth2](), [sdk](), [serverless](), [tutorial](), [tutorials]() ### AI overview This tutorial builds Recall, a small persistent-memory app on Appwrite. It hosts a stateless remote MCP server in an Appwrite Function, stores embedded memories in VectorsDB for similarity search, and uses OAuth2 for user-authorized access. It also explains connecting Claude Code to the server. ### Source excerpt Give your AI tools a shared, persistent memory. Host a stateless MCP server on Appwrite Functions, store memories in VectorsDB, and protect it with your project's OAuth2 server. ## Announcing the Appwrite OAuth2 server: Turn your project into an identity provider DevFeed: [Announcing the Appwrite OAuth2 server: Turn your project into an identity provider]() Original publisher: [Read original article]() Author: Matej Bačo Published: 2026-09-04T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [OAuth 2.0](), [OpenID connect (OIDC)](), [Authorization](), [API](), [internal developer portal]() Tags: [announcements](), [api](), [authorization](), [developer-portal](), [github](), [oauth](), [oauth2](), [oidc](), [openid-connect](), [product](), [sdks]() ### AI overview Appwrite announces an OAuth2 server that lets projects act as OAuth 2.1 and OpenID Connect providers. Other applications can register as clients, obtain user-approved scoped access to APIs, and use standard authorization and token flows. ### Source excerpt Your Appwrite project can now act as an OAuth 2.1 and OpenID Connect provider, so other apps can offer Sign in with your product and request scoped access to your APIs. ## Announcing Appwrite Apps: Create apps that build on your users' Appwrite projects DevFeed: [Announcing Appwrite Apps: Create apps that build on your users' Appwrite projects]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-09-04T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [OAuth](), [OAuth 2.0](), [API keys](), [Authorization](), [API](), [migration]() Tags: [announcements](), [api-keys](), [apis](), [authorization](), [developers](), [documentation](), [oauth](), [oauth2](), [product]() ### AI overview Appwrite announces Appwrite Apps, allowing organizations to register applications that serve other Appwrite developers. The feature uses OAuth 2.1 and OpenID Connect for consent-based, scoped access to selected projects and organizations instead of pasted API keys. ### Source excerpt Register an app in your organization and build dashboards, deployment tools, CLIs, and agents for other Appwrite developers, with consent-based, scoped tokens instead of pasted API keys. ## How to add Sign in with Appwrite to your app DevFeed: [How to add Sign in with Appwrite to your app]() Original publisher: [Read original article]() Author: Matej Bačo Published: 2026-09-04T00:00:00Z Content type: tutorial Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [OAuth 2.0](), [Authentication](), [pkce]() Tags: [authentication](), [oauth2](), [pkce](), [sign-in](), [tutorials]() ### AI overview A tutorial for enabling Appwrite's built-in OAuth2 provider so users can sign in to an app with their Appwrite account. It explains the consent and authorization-code flow, PKCE protection, and provider setup in the Appwrite Console. ### Source excerpt Let users log in with their Appwrite account using the built-in OAuth2 provider. Learn how the flow works and how to set it up end to end. ## Meet the Symfony Core Team at the API Platform Conference 2026! DevFeed: [Meet the Symfony Core Team at the API Platform Conference 2026!]() Original publisher: [Read original article]() Author: Cécile HAMEREL Published: 2026-09-02T14:30:00Z Content type: news Language: en Sources: [Symfony Blog]() Topics: [API](), [Symfony](), [PHP](), [migration](), [Domain-driven design (DDD)](), [JSON Web Tokens](), [OAuth 2.0](), [OpenID connect (OIDC)](), [Model Context Protocol (MCP)]() Tags: [2026](), [ai-agents](), [api-platform](), [conference](), [event](), [mcp](), [migration](), [oauth2](), [oidc](), [php](), [symfony]() ### AI overview The API Platform Conference 2026 will take place in Lille, France, on September 17-18. The event will feature nearly 30 talks, including sessions by Symfony Core Team members on migration, API security, DDD, HTTP headers, FrankenPHP, AI agents, and MCP. ### Source excerpt The API Platform Conference, the international event dedicated to the API Platform framework and its ecosystem, will take place in two weeks in Lille, France, on September 17-18, 2026. Nearly 30 talks are scheduled, in both French and English, covering... ## Your app is the other half of agent SSO DevFeed: [Your app is the other half of agent SSO]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-31T20:22:53Z Content type: opinion Language: en Sources: [WorkOS Blog]() Topics: [Single sign-on (SSO)](), [Authorization](), [JSON Web Tokens](), [OAuth 2.0](), [computer-use]() Tags: [ai-agents](), [app](), [authorization](), [jwt](), [oauth-2-0](), [security](), [sso]() ### AI overview This commentary explains that Okta's Agent SSO and the Cross App Access standard broker connections between AI agents and enterprise applications, but the connected application remains responsible for validating the grant and issuing its own access token. It describes the resource-side roles and the underlying OAuth and JWT-based standards. ### Source excerpt Okta's Agent SSO went GA on the Cross App Access standard. The IdP brokers the connection, but your app still has to validate the grant and issue the token. ## Type-Safe Authentication in Rust with Auth0 and Axum DevFeed: [Type-Safe Authentication in Rust with Auth0 and Axum]() Original publisher: [Read original article]() Author: Aniket Bhattacharyea Published: 2026-08-31T00:00:00Z Content type: tutorial Language: en Sources: [Auth0 Blog]() Topics: [Authentication](), [Auth0](), [Rust](), [Command-line interface](), [OAuth 2.0](), [Authorization](), [API]() Tags: [api](), [auth0](), [authentication](), [authorization](), [cli](), [oauth](), [oauth-2-0](), [rust](), [tokens](), [tutorial]() ### AI overview A tutorial showing how to build a Rust CLI that uses Auth0's OAuth 2.0 Device Authorization Flow, then create an Axum API that validates the resulting access token before allowing access to a protected route. ### Source excerpt Secure your Rust CLI applications with Auth0 Device Code flow and protect your Axum backend endpoints by validating JWTs with Rust's type safety. ## What invalid\_grant actually means, provider by provider DevFeed: [What invalid\_grant actually means, provider by provider]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-27T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [OAuth 2.0](), [Authentication](), [Google](), [Microsoft](), [Slack]() Tags: [authentication](), [bug](), [oauth](), [oauth-2-0]() ### AI overview This article explains that OAuth 2.0's invalid_grant error covers five specification conditions, while providers use the same error differently. It compares provider-specific meanings for Google, Microsoft, Salesforce, Xero, QuickBooks, and Slack, and explains why recovery depends on provider-specific error details, often with a fallback to full re-authorization. ### Source excerpt One string, five spec conditions, and a different meaning at every provider. Here is what Google, Microsoft, Salesforce, Xero, QuickBooks, and Slack each mean by it. ## Add Cross App Access to Your OIDC Resource Application DevFeed: [Add Cross App Access to Your OIDC Resource Application]() Original publisher: [Read original article]() Author: Sohail Pathan Published: 2026-08-24T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OpenID connect (OIDC)](), [API](), [Authorization](), [JSON Web Tokens](), [Single sign-on (SSO)](), [OAuth 2.0]() Tags: [api](), [authorization](), [cross-app-access](), [jwt](), [oauth-2-0](), [oidc](), [okta](), [scopes](), [sso](), [token](), [xaa]() ### AI overview This guide explains how OIDC-federated applications can support Cross App Access (XAA) for API access on behalf of users. It covers validating and redeeming the ID-JAG, resolving users from claims, issuing access tokens, updating authorization server metadata, and testing the end-to-end flow. ### Source excerpt If you currently federate enterprise customers using OpenID Connect (OIDC) and want to allow applications to access your API on behalf of those users, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your authorization server already trusts the customer's IdP for single sign-on (SSO), and XAA reuses that same trust for API access. This guide details what you need to support, how to validate the grant, and how to resolve the user at your resource authorization server. Table of Contents How XAA in OIDC works Analyzing the ID-JAG claims XAA implementation checklist for OIDC-federated applications Mapping user identity from iss and sub Validating the ID-JAG and resolving the user Issuing the access token Updating authorization server metadata Making cross-application requests from your OIDC app securely Configure your XAA OIDC Resource app in Okta Create the OIDC requesting app for testing Create the OIDC resource app in Okta Register and configure the AI Agent in Okta Verify your Okta XAA setup on xaa.dev Configure OIDC SSO Verify the refresh token exchange for an ID-JAG token Redeem the ID-JAG for an access token at the resource authorization server Call the resource API with the access token Prove the XAA connection end-to-end Takeaways for implementors who also have SAML apps Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the customer's Identity Provider (IdP) for your authorization server. Your resource server accepts the token, identifies the user, and issues your own access token, all while leaving the customer's existing OIDC integration untouched. The sequence diagram shown below describes the OIDC XAA flow. Notice that the OIDC SSO flow stays the ## Add Cross App Access to Your OIDC Requesting Application DevFeed: [Add Cross App Access to Your OIDC Requesting Application]() Original publisher: [Read original article]() Author: Sohail Pathan Published: 2026-08-21T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OpenID connect (OIDC)](), [OAuth](), [OAuth 2.0](), [JSON Web Tokens](), [API](), [Authorization](), [AI Agent]() Tags: [agent](), [api](), [authorization](), [callback](), [claude](), [cross-app-access](), [identity](), [jwt](), [oauth](), [oauth-2-0](), [oidc](), [openid-connect](), [sso](), [third-party-applications](), [token](), [xaa]() ### AI overview This guide explains how an OIDC-federated application can use Cross App Access (XAA) to request resources from a third-party application. It describes exchanging a refresh token for an Identity Assertion Authorization Grant, exchanging that short-lived JWT for an OAuth access token, and using the access token for the resource API request. ### Source excerpt If you currently federate enterprise customers using OpenID Connect (OIDC) and want to connect with third-party applications, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your app already holds an ID token after sign-in, but it's the refresh token from that same sign-in that you exchange to reach a third-party app. This guide details what you need to support and how to make resource requests to a third-party app using XAA. Table of Contents How XAA in OIDC works XAA implementation checklist for OIDC-federated applications Request the ID-JAG token Request the access token Call the resource API Handle token expiration Making cross-application requests from your OIDC app securely Configure your XAA OIDC requesting app in Okta Register the requesting app in Okta Register the test resource app in Okta Register your requesting app at xaa.dev Register and configure the AI Agent in Okta Validate the XAA connection end-to-end Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the Identity Provider (IdP) for your app's user. You exchange the ID-JAG token for an access token to the resource application you're connecting with. The sequence diagram below describes the OIDC XAA flow and how your application fits into it. You'll handle the flow in two parts: where your application requests the ID-JAG from the IdP using the refresh token, and where your app requests the access token from the ID-JAG from the third-party resource app's authorization server. XAA implementation checklist for OIDC-federated applications Follow the guide in this section to support XAA in your OIDC application when your app connects to a third-party resource application. The XAA flow places t ## Browser automation with Pydantic AI + Playwright DevFeed: [Browser automation with Pydantic AI + Playwright]() Original publisher: [Read original article]() Author: Pamela Fox (noreply@blogger.com) Published: 2026-08-20T21:57:18Z Content type: tutorial Language: en Sources: [Pamela Fox]() Topics: [Playwright](), [Pydantic](), [Browser Automation](), [Artificial Intelligence](), [Azure OpenAI](), [Entra ID](), [Authentication](), [OAuth 2.0](), [OpenTelemetry]() Tags: [agents](), [ai](), [api-keys](), [authentication](), [automation](), [azure-openai](), [browser](), [microsoft](), [microsoft-foundry](), [openai](), [playwright](), [python]() ### AI overview This tutorial explains how to combine Pydantic AI with Playwright to build agents that browse websites programmatically. It covers connecting Pydantic AI to Microsoft Foundry models through an OpenAI-compatible endpoint, using Entra token-based authentication, and applying Playwright for browsing, manual QA, and design iteration. ### Source excerpt When we build agents, we often want to give them the ability to browse the web: open webpages, navigate from one page to the other, and read the content of a webpage. By combining Pydantic AI with the Playwright capability from Pydantic AI Harness, we can build agents that browse the web safely and programmatically. Using Pydantic AI with Microsoft Foundry models Pydantic AI is an open-source model-agnostic framework from Pydantic for building LLM-based applications and agents. It's type-safe and supports OpenTelemetry, making it a great choice for robust production applications. We can use Pydantic-AI with Microsoft Foundry models using either API keys or Entra token-based authentication. When possible, we always recommend the keyless route, so that's what we'll demonstrate here. We use the azure-identity package to authenticate with Entra, using either local or managed identity, and get back a token provider callback function for that credential: from azure.identity.aio import AzureDeveloperCliCredential, get_bearer_token_provider credential = AzureDeveloperCliCredential() token_provider = get_bearer_token_provider(credential, "https://cognitiveservices.azure.com/.default") Then we use the OpenAI package to configure the model connection: from openai import AsyncOpenAI client = AsyncOpenAI( base_url=os.environ["AZURE_OPENAI_ENDPOINT"] + "/openai/v1", api_key=token_provider, ) model = OpenAIChatModel( model_name=os.environ["AZURE_OPENAI_CHAT_DEPLOYMENT"], provider=OpenAIProvider(openai_client=client), ) Let's explain the options used above: base_url: We point this at the OpenAI-compatible endpoint for our Foundry model. This endpoint works for Azure OpenAI models (like gpt-5.4, which this project deploys), and for cross-provider Foundry models that support the OpenAI v1 API, like Kimi-K2.7-Code. The base URL looks like "https://AZURE_OPENAI_SERVICE_NAME.openai.azure.com/openai/v1". api_key: We pass in the token provider callback function that generates OAuth2 token ## RFC 9470 explained: The OAuth step-up authentication challenge protocol DevFeed: [RFC 9470 explained: The OAuth step-up authentication challenge protocol]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-18T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [OAuth 2.0](), [Protocol (disambiguation)](), [API](), [Authentication](), [Authorization](), [OpenID connect (OIDC)](), [client]() Tags: [api](), [authentication](), [authorization](), [oauth](), [oauth-2-0](), [oidc](), [openid-connect](), [protocol]() ### AI overview This article explains RFC 9470, the OAuth 2.0 Step-Up Authentication Challenge Protocol. It describes how a resource server can tell a client that the current access token does not meet the required authentication level and how the client can obtain stronger authentication, including the roles of acr_values, max_age, and auth_time. ### Source excerpt How an API tells a client that the user needs to authenticate again, why acr_values is only a request while max_age is a requirement, and what the auth_time claim actually proves. ## Secure Your APIs: OAuth2 and JWT for Beginners DevFeed: [Secure Your APIs: OAuth2 and JWT for Beginners]() Original publisher: [Read original article]() Author: Alina Dolgikh Published: 2026-07-29T11:28:21Z Content type: tutorial Language: en Sources: [Kotlin : A concise multiplatform language developed by JetBrains | The JetBrains Blog]() Topics: [API](), [JSON Web Tokens](), [OAuth 2.0](), [Authorization](), [Authentication](), [backend-development](), [Security]() Tags: [apis](), [architecture](), [authentication](), [backend](), [kotlin](), [news](), [oauth](), [policy](), [spring](), [spring-boot](), [tokens](), [tutorial](), [tutorials]() ### AI overview This beginner tutorial explains how OAuth 2.0 and JSON Web Tokens (JWT) work together to secure APIs and Spring Boot backends. It distinguishes authentication from authorization, describes delegated access and token validation, and outlines how a resource server verifies bearer-token signatures, checks expiration, and enforces scopes and roles. ### Source excerpt This tutorial was written by an external contributor. APIs are frequent targets for bad actors since they expose data and functionality. Securing them while maintaining usability is often one of the most challenging and time-consuming parts of API development. OAuth 2.0 and JSON Web Tokens (JWT) help make these processes more manageable and reliable. They [...] ## Announcing OAuth Device Authorization for the Appwrite CLI: Log in from your browser DevFeed: [Announcing OAuth Device Authorization for the Appwrite CLI: Log in from your browser]() Original publisher: [Read original article]() Author: Chirag Aggarwal Published: 2026-07-29T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [OAuth](), [OAuth 2.0](), [Command-line interface](), [Authentication](), [Authorization](), [browser]() Tags: [announcements](), [authentication](), [authorization](), [browser](), [cli](), [oauth](), [oauth-2-0](), [sign-in](), [trust]() ### AI overview Appwrite announces OAuth Device Authorization for the Appwrite CLI. The CLI opens or provides a browser URL where users confirm a device code, review requested permissions, and authorize sign-in using their existing browser session instead of entering a password in the terminal. ### Source excerpt The Appwrite CLI now signs you in through your browser. Confirm a device code, review permissions, and authorize, without typing credentials into your terminal. ## Build a Flask App with Okta for Secure OIDC Login and Authorized API Calls DevFeed: [Build a Flask App with Okta for Secure OIDC Login and Authorized API Calls]() Original publisher: [Read original article]() Author: Akanksha Bhasin Published: 2026-07-28T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [Flask](), [OpenID connect (OIDC)](), [Tutorial](), [API](), [Authentication](), [Authorization](), [OAuth 2.0](), [Python](), [web applications]() Tags: [api](), [authentication](), [authorization](), [flask](), [oauth](), [oauth-2-0](), [oidc](), [pkce](), [python](), [security](), [tutorial](), [web-app]() ### AI overview This tutorial explains how to build a Flask dashboard that uses Okta OpenID Connect for user sign-in and OAuth 2.0 access tokens to call a protected backend API. It also covers PKCE, custom scopes, self-service registration, and validating scopes to control API responses. ### Source excerpt Python syntax and the flexibility of the Flask microframework make it a popular choice for quickly building web applications. While Flask provides the essentials to get you started, you'll need to tackle two critical pieces yourself: secure user authentication and authorization for your backend services. After all, how do you securely sign users into your application? And once they're signed in, how does your app fetch data from a backend service that only serves authorized requests? This tutorial shows you how to solve both. You'll build a Flask dashboard app that signs users in with Okta using OpenID Connect (OIDC). Once signed in, the app uses the resulting OAuth 2.0 access token to call a separate backend API that responds only to authorized requests. In this common pattern, a web app needs to fetch data from a protected backend service. You'll use Authlib, an OIDC client library, to configure the Authorization Code flow with Proof Key for Code Exchange (PKCE) automatically. You'll also learn how to add a custom scope to the access token and validate it on the backend to control what data the API returns. Check out the complete source code on GitHub and get started without setting it up from scratch. Table of Contents Build a Flask app with OIDC authentication Create an app integration in the Okta Admin Console Enable self-service user registration Add secure user login to a Flask application with Okta Create a basic Flask web application Configure Flask environment variables Implement the OIDC authentication logic Run the Flask OAuth web app Call a protected API with OAuth scoped tokens Build a protected users API Extend the Flask app to interact with the resource server Update the Flask UI to display protected data Test the protected API integration Learn more about OAuth and OIDC Build a Flask app with OIDC authentication In this tutorial, you'll build a simple dashboard application and learn how to: Securely sign users in to view their profile information us ## Enable Your SAML Requesting App for Cross App Access DevFeed: [Enable Your SAML Requesting App for Cross App Access]() Original publisher: [Read original article]() Author: Alisa Duncan Published: 2026-07-17T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OAuth 2.0](), [Authorization](), [JSON Web Tokens](), [OpenID connect (OIDC)](), [API](), [AI Agent]() Tags: [api](), [authorization](), [claude](), [cross-app-access](), [digital-signature](), [identity](), [idp](), [implementation](), [jwt](), [oauth](), [oauth-2-0](), [oidc](), [openid-connect](), [payload](), [saml](), [signing](), [sso](), [xaa]() ### AI overview This guide explains how SAML-federated applications can use Cross App Access (XAA) to connect to third-party applications without migrating to OpenID Connect. It covers exchanging a SAML assertion for an OAuth refresh token, an ID-JAG, and an access token, along with token validation and Okta configuration. ### Source excerpt If you currently federate enterprise customers using Security Assertion Markup Language (SAML) and want to connect with third-party applications without migrating to OpenID Connect (OIDC), this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was originally designed with OIDC in mind. To use it in SAML applications, you must accommodate specific security and uniqueness requirements. This guide details what you need to support and how to make resource requests to a third-party app using XAA. Table of Contents How XAA in SAML works XAA implementation checklist for SAML-federated applications Request the refresh token Request the ID-JAG token Request the access token Handle token expiration Making cross-application requests from your SAML app securely Configure your XAA SAML Requesting App in Okta Register and configure the AI Agent in Okta Test the SAML 2.0 app Validate the XAA connection end-to-end Learn more about Cross App Access, SAML, and OAuth 2.0 How XAA in SAML works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the Identity Provider (IdP) for your app's user. You exchange the ID-JAG token for an access token to the resource application you're connecting with. The sequence diagram shown below describes the SAML XAA flow and how your application fits in. You'll handle the flow in two parts: where your application requests the ID-JAG from the IdP using a refresh token, and where your app requests the access token from the ID-JAG from the third-party resource app's authorization server. XAA implementation checklist for SAML-federated applications Follow the guide in this section to support XAA in your SAML application when your app connects to a third-party resource application. The XAA flow places the burden of token validation onto the IdP and the resource ap ## Keycloak 26.7.0 released DevFeed: [Keycloak 26.7.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-07-09T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [API](), [Authentication](), [Authorization](), [Security](), [OAuth 2.0](), [saml]() Tags: [api](), [authentication](), [authorization](), [deprecated](), [haproxy](), [high-availability](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oauth](), [oauth-2-0](), [openid-connect](), [persistence](), [provisioning](), [release](), [saml](), [security](), [sso](), [traefik]() ### AI overview Keycloak 26.7.0 introduces preview support for SCIM-based user provisioning and simplified multi-cluster high availability, along with enhanced HAProxy and Traefik reverse-proxy guidance and step-up authentication for SAML clients. The release also adds a more secure, OAuth 2.0-compliant Identity Brokering API v2, while V1 remains enabled by default but is deprecated. OID4VCI improvements remain experimental. ### Source excerpt To download the release go to Keycloak downloads. Highlights This release features new capabilities for users and administrators of Keycloak. The highlights of this release are: Automate user provisioning with the SCIM API (preview) Simplified multi-cluster high availability without external caches (preview) Enhanced reverse proxy guides with blueprints for HAProxy and Traefik Step-up authentication for SAML clients Read on to learn more about each new feature. If you are upgrading from a previous release, also review the changes listed in the upgrading guide. Security and Standards Stronger security for the Identity Brokering API The Identity Brokering API allows applications to retrieve tokens obtained from external identity providers during federated login. Version 2 of this API replaces the legacy V1 with a more secure and standards-compliant design: Client-level authorization -- access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users. Confidential clients only -- public clients are rejected, ensuring that only authenticated clients can retrieve external tokens. OAuth 2.0 compliant -- the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields. Session-based token storage -- a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions. V2 is now supported but disabled by default. V1 is deprecated but still enabled by default for backward compatibility. In a future release, V1 will be removed and V2 will become the default. For more information, see the Identity Brokering APIs chapter in the Server Developer Guide. Progress on Verifiable Credentials (OID4VCI) (experimental) Verifiable Credentials (OID4VCI) allow organizations to issue tampe ## EvilTokens: A phishing attack that doesn't steal your password DevFeed: [EvilTokens: A phishing attack that doesn't steal your password]() Original publisher: [Read original article]() Author: Christian Ali Bravo Published: 2026-06-15T08:55:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [OAuth 2.0](), [account takeover](), [microsoft 365](), [Microsoft](), [MFA](), [Reconnaissance](), [Authorization]() Tags: [account-takeover](), [attacks](), [authentication](), [cybercrime](), [microsoft](), [microsoft-365](), [oauth](), [phishing](), [process](), [time](), [tokens]() ### AI overview EvilTokens is a phishing-as-a-service kit that abuses Microsoft 365's OAuth 2.0 device authorization flow to compromise accounts without directly stealing passwords. Victims authenticate on Microsoft's genuine login page, unknowingly approving an attacker-controlled device; the resulting access and refresh tokens can enable account takeover and business email compromise. ### Source excerpt A phishing kit subverting Microsoft's legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages ## Using Spring Boot OAuth2 for Secure Application Development DevFeed: [Using Spring Boot OAuth2 for Secure Application Development]() Original publisher: [Read original article]() Author: JOE CAVAZOS, SOFTWARE DEVELOPER @ TOPTAL Published: 2026-06-10T04:00:00Z Content type: tutorial Language: en Sources: [Toptal Blog]() Topics: [OAuth 2.0](), [Security](), [Authentication](), [Application Development](), [API](), [Code](), [configuration]() Tags: [api](), [application-development](), [authentication](), [code](), [development](), [passwords](), [security](), [spring](), [spring-boot](), [systems](), [tokens](), [validation]() ### AI overview This article explains how OAuth2 secures Spring Boot applications and enables services to exchange authorization tokens without exposing user passwords. It discusses token scope and expiration, and describes the more explicit security configuration model introduced with Spring Boot 3.x and Spring Security 6. ### Source excerpt As apps grow more complex, so does managing security. Explore how OAuth2 is implemented in Spring Boot applications and the key considerations that underpin secure communication between services. ## Announcing Keycloak's Identity Summit: KEYCONF26 DevFeed: [Announcing Keycloak's Identity Summit: KEYCONF26]() Original publisher: [Read original article]() Author: Nathalia Pinesi, Alexander Schwartz Published: 2026-05-02T00:00:00Z Content type: article Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [IAM](), [identity and access management](), [OAuth 2.0](), [OpenID connect (OIDC)](), [Single sign-on (SSO)](), [Kubernetes](), [Security]() Tags: [2026](), [conference](), [identity](), [identity-and-access-management](), [idm](), [implementation](), [kerberos](), [keycloak](), [kubernetes](), [ldap](), [oauth2](), [oidc](), [openid-connect](), [saml](), [security](), [sso](), [summit]() ### AI overview Keycloak announces KEYCONF26, its annual Identity Summit for the Keycloak user community, taking place in Prague on October 8, 2026. The event will feature interactive sessions, practical discussions, networking, and a call for speakers and sponsors. ### Source excerpt Our annual conference dedicated to the Keycloak user community returns, with even more content and networking opportunities than last year. It's the perfect place to interact, learn, share, and exchange insights and real-world use cases, network with fellow experts, users, and contributors. 📍 Introducing KEYCONF26 - taking place in Prague on October 8th, 2026! This year's edition of the Keycloak Identity Summit features interactive sessions, and even more opportunities to engage with the people shaping the future of identity and access management. Call for sessions The call for sessions is open until May 24th, 2026 -- we'd love to hear from you! We're looking for sessions on topics such as: Keycloak deployment and operations at scale Human and non-human identities in the world of AI OAuth2, OIDC, and evolving identity standards Security best practices and hardening EU Digital Identity Wallets and eIDAS Migration stories and real-world use cases Extending and customizing Keycloak Submit your proposal now! What to expect at KEYCONF26 Inspiring Keynote Speaker Hear from Hannah Short, Team Lead for Identity and Access Management at CERN, how they are using Keycloak as a highly performant and reliable SSO running on Kubernetes. Connect with like-minded professionals From long-time contributors to those just starting their IAM journey, KEYCONF26 is the perfect place to meet others working with identity, OAuth2, OIDC, and more. Networking lunch Our extended lunch break is designed to help you meet fellow attendees, swap ideas, and build meaningful professional connections in a relaxed setting. Business drinks Stick around after the last session for informal networking over drinks. Want to sponsor this year's Business Drink? Get in touch with us--we'd love to partner with you! Expert sessions and real-world use cases Gain practical insights into Keycloak implementation, security improvements, OAuth2 best practices, and evolving identity standards. Learn how to use EU Digital [Next page]()