Skip to content

Standard Reader

Tag

Pkce

Articles and publications tagged Pkce across the Atmosphere.

2articles2publications

Articles

Publications

eiuspkz

eiuspkzNov 3, 2026

Why PKCE must bind the authorization request, code, and verifier

Binding authorization codes and PKCE verifiers to one transaction without weakening downgrade checks.

subaud

subaudApr 3, 2026

Adding OAuth to an MCP Server: From API Keys to Browser Login

MixCraft started with static API keys—generate one from the web portal, paste it into your Claude Code config. The mx_ prefixed keys had no expiration, lived in shell history and dotfiles, and revoking one meant generating a new key and updating every client. Service tokens from third-party APIs expired after an hour with no refresh mechanism, so users would get silent failures mid-session. I needed to replace the whole auth model with OAuth. But worse, it didn't work well with claude.ai because

You've reached the end.