Authentication
17 guides tagged “Authentication”.
- Service Account vs API Key: Which Should You Use? A service account is an identity with permissions; an API key is a bearer credential. Confusing the two leads to keys with more access than needed.
- What Are the Types of Non-Human Identities? Service accounts, API keys, OAuth clients, certificates, workload identities, and agent tokens differ in lifetime and in the control that matters.
- What Is a Stale Non-Human Identity? A stale NHI is a credential nobody uses but that still authenticates. It is a standing backdoor with no owner and no expiry.
- What Is SPIFFE and SPIRE? SPIFFE is an identity standard for workloads; SPIRE is its reference implementation. Together they replace shared secrets with attested certificates.
- What Is Workload Identity? Workload identity gives a process a short-lived credential based on what it is, not a static secret it carries. It removes the key from the deploy path.
- Session Cookies vs JWT: Which Should You Use? Sessions and JWTs solve the same problem differently. Compare revocation, storage, scale, and attack surface, and get a direct recommendation.
- Add Accounts and Login to Your App A project-based journey for AI builders: choose an auth method, hash passwords, add sessions, and prove one user cannot read another user's data.
- Authentication and Authorization for AI Builders: Who You Are, and What You're Allowed to Touch Login, sessions, JWTs, OAuth, passkeys, and the object-level checks your AI assistant skips. Every auth concept a vibecoder needs, with a linked guide for each.
- The 12 Authentication Mistakes That Show Up in AI-Generated Apps Reversible password storage, unverified tokens, sessions that never die, enumerating logins, bypassable MFA, and unprotected endpoints — twelve auth defects generated code ships with, and the fix for each.
- How to Choose an Authentication Method for Your App: A Decision Guide Sessions, JWTs, OAuth, passkeys, magic links, or SSO — the six questions that decide your auth method, a comparison table, and the cases where each option is the wrong pick.
- What Are the Different Types of Authentication (and What Is Each One For)? Passwords, one-time codes, passkeys, magic links, social sign-in, SSO, certificates, and API keys — how each authentication type works, what it's for, and where it's weak.
- JWT Security: Common Mistakes That Get Tokens Stolen JWTs are easy to generate and easy to get wrong. Learn the mistakes — algorithm confusion, weak secrets, no expiry — that turn tokens into access.
- What Are Passkeys (and Should You Switch)? Passkeys replace passwords with cryptographic key pairs unlocked by your device, resisting phishing. Learn how they work and whether to switch.
- How to Prevent Credential Stuffing Attacks Stop credential stuffing with multi-factor authentication, rate limiting, breached-password detection, and bot detection. Practical steps for any web app.
- What Is OAuth 2.0? OAuth 2.0 is a framework that lets apps access your data on another service without sharing your password. Learn the flows and core concepts.
- What Is Phishing-Resistant MFA? Phishing-resistant MFA uses FIDO2 passkeys or hardware keys that can't be tricked by fake sites — unlike SMS codes. Learn why it's the new baseline.
- What Is Credential Stuffing (and How Does It Get Your Accounts)? Credential stuffing reuses passwords leaked from one site to break into others. Learn how the attacks work and why unique passwords are the only real defense.