Sauvik Biswas

Tales From a Startup: Opinions

Token Exchange (On-Behalf-Of): Swapping Tokens for Downstream APIs

Resource Indicators: Binding Tokens to a Specific API

JWKS and RS256: Dropping the Shared JWT Secret

Intermission: What Industry Ships and Who Gets Paid

Adding OpenID Connect on Top of OAuth 2

JWT Access Tokens: Local Validation Without the Introspection Hop

Splitting the Auth Server from the Resource Server

Refresh Tokens and Silent Re-authentication

Using the Access Token on a Protected API