Developer recipes
Copy-paste, framework-agnostic recipes for the identity work developers actually do. Each one is built on the open standards, links to the spec it implements, and avoids any single vendor. Free to read and use, no email required.
Wire OpenID Connect authorization code flow with PKCE into the Next.js App Router, with httpOnly session cookies and no client-side token storage.
The canonical, framework-agnostic walkthrough of the authorization code grant with PKCE, the flow OAuth 2.1 recommends for every client type.
Verify a JSON Web Token's signature against a provider's JWKS and check every claim that matters, with the pitfalls that cause real vulnerabilities.
Turn any HTTP API into an OAuth 2.1 resource server: validate the bearer access token, enforce scopes per route, and return correct error responses.
Build a SCIM 2.0 server so identity providers can create, update, and deprovision users in your app automatically, with the minimum endpoints that satisfy real connectors.
Implement passkey registration and login using the WebAuthn API and a server-side verification library, the phishing-resistant replacement for passwords.
Five Conditional Access policies that cover most of the risk in a Microsoft Entra tenant, built in report-only first, with the break-glass exclusion wired in from day one.
Create two cloud-only Global Administrator accounts that still work when federation, MFA devices, or Conditional Access fail, protect them with FIDO2 passkeys, and alert on every sign-in.
Require passkeys or Okta FastPass for a pilot group in Okta Identity Engine, using the global session policy, an authenticator enrollment policy, app sign-in policy rules with the Phishing resistant constraint, and a deny-by-default catch-all.
Make Entra ID or Okta the identity source for AWS IAM Identity Center: exchange SAML metadata, turn on SCIM so users and groups sync automatically, then grant access with permission sets and account assignments from the console or the AWS CLI.
Let employees sign in to the Google Cloud console and gcloud with their existing Entra ID or Okta account, with no user sync into Cloud Identity and IAM roles granted to IdP groups.
Replace stored cloud access keys and client secrets in GitHub Actions with short-lived OIDC federation, and scope the trust to an exact repository, branch, or environment.
The admin side of SCIM: connect Microsoft Entra ID or Okta to a SaaS app's SCIM endpoint, get the matching attribute and mappings right, scope who is provisioned, and prove with a joiner-mover-leaver test that leavers lose access and sessions.
Export Auth0 profiles, get the bcrypt password hashes through support, then move users with a bulk hash import, a lazy migration, or both, without breaking the sub claim your apps depend on.
The per-app procedure for moving one SAML relying party trust from AD FS to a Microsoft Entra enterprise application, with a tested cutover and a rollback that takes minutes.
Make the identity provider the only way into GitHub, Atlassian, and Slack: enforce SSO, keep one or two break-glass admins, end old password sessions, close the token side doors, and alert on what is left.
Give each Kubernetes service account its own short-lived cloud identity on EKS and GKE, so pods stop using node credentials or mounted keys.
What to do in the first hour after a GitHub token, AWS access key, or Stripe API key leaks: contain it, move consumers to a new credential, read the logs back to the leak date, and stop the next one.