Featured articles
Archive
Category: OAuth
OpenAI Launches Sign in with ChatGPT (Based on OpenID Connect)
(Work in progress; last updated 2026-10-02 12:39 JST) On September 29, at DevDay 2026, OpenAI officially announced Sign in with ChatGPT (SIWC). I would like to check the details my…
【Announcement】Is That QR Code Safe? Threats and Countermeasures in Cross-Device Authentication and Authorization Flows【YouTube Live】
On August 22 (Thursday), starting at 20 hours, we will host a YouTube Live stream titled “Is That QR Code Safe? Threats and Countermeasures in Cross-Device Authentication and Autho…
I Heard the Striking Question, “Why Do We Need Access Tokens? Couldn’t We Just Store Passwords?” So Here Is an Explanation
One reader of the ID book asked the striking question, “Why do we need access tokens? Couldn’t we just store passwords?” Come to think of it, I had not explained such a basic…
Authlete Features for OAuth/OIDC Profiling: A Summary
As many of you may know, I serve as an outside director of Authlete Despite that, I had not kept up with the latest developments, so I decided to learn from a video of Mr. Morikawa…
I Asked ChatGPT to Explain ID Tokens and Access Tokens in the Style of the King James Bible
People in the community have been having fun asking it to explain various things, and among them, Sarah Cecchetti, Head of Cognito at AWS, had it produce an amusing passage. Write…
[2020-09-17] I Appeared on Citi Talks on Payments
I appeared on a YouTube channel run by Citi. It is an interview about OpenID, FAPI, and related topics.
Open Banking Conformance & Certification Workshop
This is yet another extremely late announcement, but today, 4/27, beginning at 10 p.m. Japan time, the UK Open Banking Implementation Entity and the OpenID Foundation will jointly…
I Will Speak at APIDays London (11/13)
This announcement could hardly be any later, but I will appear at APIDays London on the 13th from 11:10 a.m. local time. The APIDays London website is here: https://www.apidays.co/…
The Only Case in Which You May Use the Password Grant: A 2-Minute OAuth Lesson
In the previous video, I explained that OAuth’s Resource Owner Password Credentials Grant must not be used except for backward compatibility. I then received a question askin…
When Should OAuth’s Password Grant Be Used? [2-Minute OAuth Lesson]
OAuth has something called the “Resource Owner Password Credential (ROPC) Grant.” In fact, some banks use it, and I occasionally receive questions from developers who have s…