Blog

Engineering Notes

Practical thinking about backend architecture, identity and the places where production systems become difficult. Concepts and design guidance, without invented incident stories.

02Identity

Debugging OAuth 2.0 and PKCE in SPAs

Follow the authorization-code flow one boundary at a time, and distinguish the browser, identity provider and API responsibilities.

1 min read

Contact

Have a difficult .NET problem?

Need help with a microservices architecture, production issue, authentication problem, or distributed system?

Let’s Talk