Skip to content

docs: design-learnings guides (#3) - #8

Merged
gmoon merged 1 commit into
mainfrom
docs/design-learnings
Jul 19, 2026
Merged

docs: design-learnings guides (#3)#8
gmoon merged 1 commit into
mainfrom
docs/design-learnings

Conversation

@gmoon

@gmoon gmoon commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

Closes #3. Five vendor-neutral design guides under docs/, each structured problem → options → tradeoffs → recommendation:

  • bff.md — server-side sessions over upstream OIDC; why tokens never reach the browser; identity from the id_token
  • device-flow.md — RFC 8628 device grant; first-party grant + delegated identity
  • machine-clients.md — API key → short-TTL JWT + JWKS; local verification; both modes first-class
  • enterprise-sso.md — you're the relying party, not the IdP; home-realm discovery; build-vs-buy
  • choosing-an-approach.md — decision guide across roll-your-own / BFF / hub / broker / self-hosted, and when self-hosting is actually right

Linked from a new README "Design notes" section. Vendor-neutral throughout — products named only as category examples. Docs-only; CI should pass.

🤖 Generated with Claude Code

…SO, decision guide)

Closes #3. Five vendor-neutral guides under docs/, each
problem → options → tradeoffs → recommendation:
- bff.md — server-side sessions over upstream OIDC; identity from the id_token
- device-flow.md — RFC 8628, first-party grant + delegated identity
- machine-clients.md — API key → short-TTL JWT + JWKS, local verification
- enterprise-sso.md — RP-not-IdP, home-realm discovery, build-vs-buy
- choosing-an-approach.md — decision guide + when self-hosting is actually right
Linked from the README Design notes section.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@gmoon
gmoon merged commit 7ebd7e6 into main Jul 19, 2026
3 checks passed
@gmoon
gmoon deleted the docs/design-learnings branch July 19, 2026 01:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

docs: publish auth design learnings (BFF, device flow, RP-not-IdP SSO, self-host vs managed vs broker)

1 participant