Auth
Proving who is calling and deciding what they may do — the half of a service that is never "just a library".
7 topics
Authentication vs Authorization
Two questions that get conflated — who is calling, and what they may do — and why the second one is where breaches actually happen.
core20 minSessions & Cookies
The boring, correct default for browser auth — an opaque session ID in a hardened cookie — and the four attributes that make it safe.
core25 minJWT & When Not to Use It
What a signed token actually buys you, the revocation problem it creates, and the narrow cases where it's the right answer.
core25 minOAuth 2 & OIDC, Server Side
The authorization-code flow as the server actually implements it — redirects, PKCE, state, token exchange — and what OIDC adds on top.
core30 minAuthorization Models & Multi-Tenancy
Choosing between roles, attributes and relationships — and enforcing tenant isolation somewhere it can't be forgotten.
core25 minAPI Keys & Service-to-Service Auth
Authenticating callers that aren't people — how to store a key, scope it, rotate it, and what replaces keys between your own services.
core20 minCredentials, MFA & Account Recovery
Password hashing that's still correct in 2026, the second factors worth offering, and why recovery is the weakest link in every auth system.
core25 min