Blog

AI agents are reading your documentation. Here's what WorkOS did to serve them clean markdown instead of unparseable HTML.

Identity, authorization, and oversight patterns for systems that act on their own.

Master Spring Security authentication from form login and JWT to enterprise SSO, with production-ready patterns across Spring Boot, Quarkus, and Micronaut.

Build a Node app that lets users connect Notion and list their pages with a refreshed access token, without implementing OAuth.

An opinionated checklist for the auth decisions you'll actually have to make.

Picking a library, choosing where to verify, and avoiding the mistakes that quietly break security.

Stytch works, until your enterprise deals outgrow it. Here's what to use instead.

A practical walkthrough of RFC 9449 for engineers: the proof JWT, server-issued nonces, key storage in the browser, and where DPoP fits next to mTLS.

How LLMs leak data, get hijacked, and turn friendly inputs into exploits, and why most of the defenses live outside the model.

The one layer of your app where 'seems to work' isn't good enough.

Everything you need to know to implement and validate JWTs securely in Java: from signing to verifying with JWKS, with code examples and best practices throughout.

Your agent has access to a database, a file system, and an email sender. Each tool is legitimate. The misuse is in the combination.

How a prototype pollution bug in one library and a missing header check in another nearly chained into AWS credential theft.

Master secure authentication in Go, from middleware design and JWTs to session management and enterprise SSO, with production-ready patterns and security best practices.

Harness CEO Jyoti Bansal discusses AI-native software delivery, developer productivity, and where the industry is headed. Interview from HumanX 2026.