Articles for people who
ship the stack
Rewrites on React, Node.js, TypeScript and AI. A translated body is shown when it exists. If it does not, you see the English text and a note that says so.
Tagged: Authentication
Is Your API Ready for AI Agents? A Practical MCP Readiness Checklist
Is your API ready for AI agents? An MCP readiness checklist: docs, schemas, authentication, which endpoints to expose, descriptions, testing and versioning.
12 min readWhat MCP's Stateless Core and Managed Auth Mean for Integration Teams
Linux Foundation governance, stateless HTTP transport and identity-provider-managed authorization make MCP viable for enterprise integration. Here is what changed.
7 min readPlaywright MCP Profiles: Why Login State Persists or Disappears
Playwright MCP profiles explained: how persistent, isolated and extension modes treat cookies and login state, how to tell which one runs, and security notes.
5 min readKeycloak refresh tokens and session timeouts explained
Why Keycloak refresh returns 400, how Idle and Max session timeouts differ, and how to single-flight refresh tokens with rotation-safe storage in JavaScript.
7 min readMapping the Auth Vocabulary: API Keys, Sessions, JWT, OAuth2, OIDC, SSO
Learn how API keys, sessions, JWTs, OAuth2, OpenID Connect and SSO fit together by sorting each one under a single question: who is calling, or what may they do.
10 min readMoving a React App's JWT Out of localStorage and Into HttpOnly Cookies
Learn why localStorage JWTs fall to any XSS, how HttpOnly cookies with SameSite, rotation and a BFF shrink the risk, and which pitfalls remain in React apps.
9 min readAxios Interceptors as HTTP Middleware: A Mental Model for React Apps
Understand how Axios request and response interceptors work as middleware, what belongs in each, and how they centralize auth headers and 401 handling in React.
6 min readUntangling an Angular AuthService: Gateway, Store, Facade and Ports
Split a bloated Angular AuthService into a gateway, a signal store, a storage port and a facade, with single-flight token refresh, a scoped interceptor and testable guards.
17 min readBlocking Undeliverable Sign-Up Emails with a Supabase Auth Hook and DNS
Use a Supabase before-user-created hook and MX, A and AAAA lookups to reject sign-ups whose email domain cannot receive mail, following the rules in RFC 5321.
7 min read
About these articles
Request a 24h estimate
Need the same stack in a production operator layer? Send the brief — estimate within 24 hours.