What is TOTP? A short guide for developers (RFC 6238 explained)
What is TOTP (Time-based One-Time Password)? A concise RFC 6238 explanation for developers with code examples (Node, Python, Go), troubleshooting tips, and a free online TOTP tool.
The Complete Guide to Machine-to-Machine (M2M) Authentication — OAuth Client Credentials Flow
Learn how M2M tokens work, implement OAuth 2.0 Client Credentials, host JWKS, rotate keys, and secure service-to-service authentication with examples in curl, Node, Python, and Go.
What Is JWKS? JSON Web Key Set and JWKS URI Explained
Learn what JWKS is, how JWKS URI works, JWK format examples, and practical tips to generate and manage keys for secure token verification.
JWE vs JWT: Key Differences, Use Cases, and Security Tips
Learn the differences between JWE and JWT, when to use each, and how to secure your tokens. Includes free debugging and key generation tools.
JWT Authentication: A Secure & Scalable Solution for Modern Applications
Learn how JWT authentication works, its pros and cons, and when to use it for secure, scalable applications. Explore alternatives like OAuth, API keys, and SAML for authentication and access management.
What is Role-Based Access Control (RBAC)? Benefits, Comparisons, and Best Practices
Learn everything about role-based access control (RBAC), its benefits, pros and cons, key rules, and comparisons with ABAC and ACL. Discover how Authgear simplifies RBAC for secure and scalable access management.
PKCE in OAuth 2.0: How to Protect Your API from Attacks
Learn everything you need to know about PKCE, a security extension for OAuth 2.0 that helps protect your API from authorization code interception and other attacks. Discover how PKCE works, its benefits, and best practices for implementation.
How to Add Authentication to a React Native app in 10 Minutes
In this we teach how add a full user authentication feature to any React Native application under 10 minutes.
How Does Biometric Authentication Work? A Comprehensive Guide to the Future of Security
Discover how biometric authentication works, from fingerprints to facial recognition. Explore the technology, benefits, challenges, and its role in shaping the future of secure identity verification.
Password Hashing: How to Pick the Right Hashing Function
Almost all popular online services use some form of hash technique to store passwords securely. In this post we cover the different hashing functions, best practices and how to pick the best one for your application and organisation.
Add Social Login to Your Laravel Project Using any Provider
Social login allows users to log in to your website using their existing account on social sites like Facebook, Twitter (X), and Google. In this post, we show how to implement social login in a Laravel project using any social login provider.
Defend Against Broken Access Control: Protect Your Application Today
What is Broken Access Control? Clear examples, API/IDOR scenarios, and a practical prevention checklist (RBAC/ABAC, deny-by-default, testing). Updated for the coming OWASP Top 10 2025.
How OAuth 2.0 Works: A Developer's Guide (2026)
OAuth 2.0 is the standard behind "Sign in with Google" and every major API. Here's exactly how it works, with diagrams and code.
Authentication for ASP.NET apps with Authgear and OpenID Connect
This blog post demonstrates how to add authentication features to ASP.NET apps with Authgear by implementing an OpenID Connect flow.
Get Notified in Slack for Every New User Sign Up With Authgear
This article will guide you through the process of integrating Authgear's Hooks and Events with Slack to send immediate notifications in Slack when a new user signs up.
Add Authentication to Any Web Page in 10 Minutes
This post demonstrates how to easily add authentication to any Javascript Single Page Application (SPA) using Authgear.
How Profile Enrichment can boost your product
Explore how enriching user profiles work, their benefits, and how you can enable it using Authgear to boost your product usage by understanding who your customers are.
Authentication for Spring Boot App with Authgear and OAuth2
Learn how to add authentication to your Java Spring Boot application using OAuth2 with Authgear as the Identity Provider.
Simplifying Authentication Integration For Developers With Authgear SDKs
Authgear SDK libraries make it easy for developers to integrate and interact with Authgear.
Password Spraying: What It Is and How to Prevent It?
Learn more about password spraying and the different methods to protect your users from it with Authgear.
What Is Session Management: Threats and Best Practices
Session management is the process of handling interactions between a user and a web application. To understand its importance, consider that HTTP, the protocol underlying the web, is stateless. This means each request from a user is treated independently, and the server has no inherent way to remember or track a user's actions across multiple requests. Session management addresses this by creating a session—a series of related user interactions within a specific timeframe. By managing sessions effectively, web applications can maintain user state, personalize experiences, and enhance security. In this article, we'll delve into the complexities of session management, explore potential threats, and provide best practices to safeguard your web application.
Credential Stuffing: What It Is and How to Prevent It?
Credential stuffing is a type of cyberattack involving use of stolen credentials and bots to gain access to user accounts. Learn more about it and how to prevent it with Authgear.
4 Things We Learned Supporting Passkeys
Passkeys have the potential to completely replace passwords, but it isn't perfect yet. Learn more about what you might encounter when supporting them.
From Login to Lockdown: Building Secure Authenticated Applications
Master the art of building secure authenticated applications. Learn about authentication methods, access tokens, and implement robust security with Authgear. Your comprehensive guide to safeguarding user data.