Claude Code built the caseworker admin console for my apidays workshop demo and every check it ran passed - type check, lint, build, direct FGA queries. The first time I actually clicked the button, we found five separate bugs, one in each layer of the stack.
Toby Allen
Solutions Engineer at Okta. I write about identity, access management, and security. This site archives my published articles, talks, and presentations.
Series - Indepth Explainers
Latest
What's New in the Auth0 Session and Token Guide: Token Vault and Session Delegation
· Auth0, Customer Identity Products, Identity Security
Four separate follow-up posts are now folded into the main guide instead of sitting as bolted-on updates at the bottom - two new grant types for devices with no browser of their own, and two new use cases worth building around: Token Vault and Session Delegation.
Auth0 Session Delegation: Two Silent Failures and One Bug of My Own
· Auth0, Customer Identity Products, Identity Security
Every SaaS company with a support team eventually needs a 'log in as this customer' button, and most build it badly. Auth0's new Session Delegation feature is a paved path for it - an audited, time-boxed session with an act claim naming the agent. Wiring up a genuine one meant fixing two failures Auth0 never surfaces as an OAuth error, then a bug entirely of my own making.
I told myself three times that checking requirements was a good idea
· Auth0 FGA, AI Agents, MCP
Part three of building the apidays workshop demo with Claude Code. Three separate times in one session I went back to the original brief and found real drift - and each time I described it to myself as though it were a fresh insight, rather than noticing I'd said the same thing before.
Session assurance: what a login proves depends on how it happened
· Auth0, Customer Identity Products, Auth0 FGA
Verification level answers who a persona provably is, established once and true forever. Session assurance answers something else entirely - how strongly the current login just proved it - and it has no business being stored as a fact at all.
What Claude Code got wrong building the apidays demo (and how I caught it)
· Auth0 FGA, AI Agents, MCP
Part two of the apidays workshop series moves from planning to building. Claude reversed a hosting decision that turned out to be solving a problem that never existed, then quietly let a fourth infrastructure provider into a build I'd explicitly ruled out - twice.