#OAuth
11 related articles
OAuth Authorization for AI Agents: What the Four Major Extensions Cover and What Gaps Remain
Analyzing how four OAuth extensions—RAR, DPoP, CIMD, and Transaction Tokens—provide authorization binding for AI agents, and identifying three unresolved gaps: cross-agent delegation traceability, intent consistency verification, and long-running task token management.
ScaleKit in Practice: Building a DevOps AI Agent with Per-User OAuth
A breakdown of building a DevOps AI Agent with Per-User OAuth using ScaleKit, connecting GitHub, Linear, and Slack to avoid shared-credential security traps, plus key auth and permission design points for production AI Agents.
MCP Security Storm: OAuth SDK Vulnerability Testing and Server Hardening Guide
2026 saw a wave of MCP OAuth vulnerabilities: TypeScript and Python official SDKs both hit high-severity issuer confusion bugs, and LiteLLM auth bypass entered CISA's exploited list. This article covers CVE details, local reproduction results, and a full client/server hardening checklist.
Step-by-Step Guide to Connecting Gmail to n8n with Custom Google OAuth
Complete tutorial for connecting Gmail to n8n with custom Google OAuth credentials: create a Google Cloud project, enable the Gmail API, configure the redirect URI, add test users, and verify email sending with a minimal workflow.
Building Multi-Tenant MCP Servers with OAuth: Secure Integration for Claude and ChatGPT
Learn how to build an OAuth-enabled multi-tenant MCP server to securely connect SaaS products to Claude and ChatGPT, covering authentication, token security, and tenant isolation.
F5 BIG-IP APM Critical Vulnerability CVE-2026-94127: Unauthenticated Remote Code Execution via OAuth Configuration
F5 BIG-IP APM CVE-2026-94127 (CVSS 9.8): unauthenticated RCE via OAuth Authorization Server config. Covers trigger conditions, why Appliance mode fails, F5's three detection indicators, and iRule vs. hotfix remediation order.
MCP OAuth in Practice: Give Your AI Agent a Key, Not Your Password
MCP authorization spec uses standard OAuth to give AI agents scoped tokens instead of master keys. This guide walks through 401 discovery, PKCE, resource params, scope validation, and step-up auth.
Sign in with ChatGPT: The Login Button That Consumes Your Subscription Quota
Sign in with ChatGPT introduces a scope that consumes users' paid subscription quota. This article breaks down the authorization risk model and what developers must evaluate before integrating.
Device Code Phishing Exposed: How EvilTokens Bypassed Passwords to Compromise 12,000 Mailboxes
Microsoft seized EvilTokens phishing service that compromised 12,000 mailboxes without stealing passwords by exploiting OAuth Device Code Flow. Learn how it works and how to defend against it.
CoPhish Attack: The New OAuth Phishing Threat in the Age of AI Agents
CoPhish reveals how agent-building platforms can become OAuth phishing vectors. Covers attack mechanics, MCP server defenses, Entra Agent ID, and WorkOS Agent Auth.
What Is an MCP Server? From Zero to Production-Grade Deployment
What is an MCP server? This guide explains how the Model Context Protocol works, builds tools with Python and FastMCP, and covers remote deployment with OAuth 2.1 authentication for production use.