I'm a senior blockchain and full-stack engineer. Before EmbedAuth I spent years shipping production systems where authentication, session management, and key handling were never optional — and where getting them wrong meant losing user funds, not just a bad login screen.
That background is why EmbedAuth treats auth as a security surface, not a feature checkbox. Token rotation, iframe sandboxing, JWT signing keys, OAuth callback hardening — these decisions ship by default, not as add-ons.
Everything I publish here comes from building and operating real authentication systems, not from summarizing other blog posts. When I describe a failure mode — algorithm-confusion attacks on JWTs, refresh-token reuse detection, account enumeration through timing — it's because I've had to design against it. Where there's a genuine tradeoff (stateful vs. stateless sessions, synced vs. device-bound passkeys), I try to lay out both sides rather than pretend there's one right answer.
My goal is that an engineer can read a piece, understand why a recommendation exists, and apply it the same afternoon.
If you want a topic covered in depth, open an issue on GitHub or message me on LinkedIn. I read every one.
Passwordless
Authentication
Authentication
Multi-Tenant Auth
Security
OAuth & OIDC
Passwordless
React Auth
JWT
Security