This is the engineering and product blog of LumoAuth, a hosted authentication and authorization service with two jobs: passwordless sign-in for people, and identity plus guardrails for AI agents.
We write about the things we build and the standards they sit on: passkeys and magic links, enterprise SSO and directory sync, OAuth 2.1, token exchange, rich authorization requests, HTTP message signatures, DPoP, MCP server authorization and human-in-the-loop approvals for agents.
What to expect
- Explainers and standards deep dives, with links to the RFCs.
- How-tos that run against the real SDKs and API.
- Comparisons with other identity platforms, dated and sourced.
- Checklists and scenarios for teams putting agents into production.
Follow along
Subscribe to the Atom feed, read the documentation, or start free with ten agents and one MCP server on the Developer plan.