Build
Docs, protocols and field notes.
Integrate sign-in, provisioning and audit. Read how the protocols work.
Latest field notes
Merging two directories after an acquisitionMerging two directories safely means matching people on verified keys, never on names alone, and migrating in stages with a way back.Access reviews that auditors acceptAn access review is a process, and the evidence matters as much as the decisions. Scope it, assign named reviewers, record decisions and keep the proof in one folder.Implementing OpenID Connect with PKCE correctlyAuthorization code with PKCE is the recommended flow for web, mobile and single-page apps. Generate a verifier, send its hash, and check state, nonce, signature, issuer, audience and expiry on return.