A company registry needs three things a subscription service doesn't: a public entry anyone can search, a governance role distinct from day-to-day admin, and proof that whoever holds that role is who they say they are.
Toby Allen
Solutions Engineer at Okta. I write about identity, access management, and security. This site archives my published articles, talks, and presentations.
Series - Indepth Explainers
Latest
Building Embedded Passkey Login with Auth0
· Auth0, Customer Identity Products, passkey
Auth0's Passkey APIs let you build passkey sign-in directly into your own UI instead of redirecting to Universal Login. Here's how that fits alongside Universal Login, what self-service passkey management looks like hand-rolled versus with Auth0's official pre-built components, and one Allowed Origins (CORS) setting worth checking before you go looking for a WebAuthn bug that isn't there.
One authorisation model, a dozen industries
· Auth0, Customer Identity Products, Auth0 FGA
It's easy to claim an authorisation model is generic. It's more convincing to run the exact same model, unmodified, across media, healthcare, financial services, telco, retail and legal case management, and show the tests passing every time.
Auth0 Anonymous Sessions: Cookies and Metadata Are Both Fixed at Creation
· Auth0, Customer Identity Products, Identity Security
An anonymous session's cookie and its metadata are both set once, at the moment the session is created, and neither one changes again for the rest of that session's life. That single fact reshapes how you have to track state across the handoff into a known identity.
Separating people from accounts: why a login isn't a person
· Auth0, Customer Identity Products, Auth0 FGA
The delegated-access series treated the authenticated login as the whole security principal. It isn't quite. The same real person routinely holds more than one login, and an authorisation model that can't tell them apart ends up merging blast radii it shouldn't.
Decoupling Social Post Scheduling From Blog Deploys
· GitHub Actions, Automation, Web Development
This blog's cross-posting to Bluesky, Mastodon, and LinkedIn used to only fire as a side effect of a successful Vercel deploy, which meant a social post could never exist without a brand new article behind it. I pulled the two apart into an independent queue, and found neither LinkedIn nor Bluesky actually auto-fetch a link's image the way the compose box makes you assume.