Our latest Blog Posts
We write stuff from time to time that might be interesting
What Is SPIFFE? Workload Identity and SVIDs Explained
SPIFFE and SVIDs explained: how SPIFFE gives workloads a cryptographic identity, what a SPIFFE ID and SVID are, how SPIRE issues them, and how they enable mTLS.
Read post
Machine-to-Machine (M2M) Authentication Explained
Machine-to-machine (M2M) authentication explained: how the OAuth client credentials grant works, how a service proves its identity, and why short-lived and mTLS beat shared secrets.
Read post
How the mTLS Handshake Works, Step by Step
How the mTLS handshake works, step by step: the TLS 1.3 message flow with client authentication, the CertificateVerify proof-of-possession step, and certificate validation.
Read post
mTLS vs TLS: What's the Difference?
mTLS vs TLS explained: TLS authenticates the server, mTLS authenticates both client and server. See the key differences, when to use each, and how they work together.
Read post
What Is mTLS? Mutual TLS Authentication Explained
mTLS (mutual TLS) explained: how mutual TLS authenticates both client and server, how the handshake works, when to use it, and how certificate-bound tokens stop stolen tokens.
Read post
The OAuth 2.0 Authorization Code Flow, Explained
The OAuth 2.0 authorization code flow explained. How the redirect and code exchange work step by step, why PKCE is the default, when to use it, and mistakes to avoid.
Read post
What Is OAuth 2.0? How It Works and When to Use It
What is OAuth 2.0? A plain-English guide to the authorization framework: the four roles, the authorization code flow with PKCE, grant types, and OAuth vs OIDC.
Read post
OpenID Connect vs OAuth: What OIDC Adds and When to Use It
OpenID Connect vs OAuth: OAuth authorizes access, OIDC adds authentication with an ID token. See what OIDC adds, the ID token claims, and when to use each.
Read post
Authentication vs Authorization: What's the Difference?
Authentication vs authorization explained: authentication proves who you are, authorization decides what you can do. See the difference and where each runs.
Read post
JWT Token: What It Is, How It Works, When to Use It
A clear guide to the JWT token: its header, payload, and signature, the claims inside, how validation works, and when to use a JWT versus an opaque token.
Read post
Next.js Authentication: The Complete 2026 Guide
Add authentication to Next.js with protected routes, sessions, OAuth, and OIDC — without rolling anything from scratch.
Read post