API Security Blogs

Ping Identity is one of the first companies to achieve FAPI 2.0 certification. Read this blog post for more details.

In spite of the popularity of JWTs, their security properties are often misunderstood. To ensure the security of the app, you must fully consider asymmetric signatures, validation beyond signatures, cryptographic key management and more. Learn how to put JWT security best practices into place.

APIs pose a significant cyber security threat, making API security a critical priority. Learn everything you need to know about API security.

Learn how webhooks—a mechanism for sending post-event app-to-app notifications—can save time and resources and result in a better customer experience.

Get rid of pesky passwords to make your customers happy all the while making your app more secure with passwordless authentication. Passwordless authentication helps both developers and end users escape the friction of passwords while creating a great user experience.

The flow of the implicit grant type of the OAuth 2.0 spec is broken down in an easy to understand way with recommendations on when to use it.

Gain a better understanding of one of the most commonly used OAuth 2.0 grant types: the Authorization Code Grant Type (Auth Code). By examining the flow backwards, you’ll understand why the particular process came about and learn how you can use Auth Code to achieve a problem’s desired solution.

Read this blog post to learn more about reusing OAuth2 Access Tokens for different resources (APIs advertised on an API Gateway). The post looks at some of the supporting concepts that impact how the options work and guides you to a deeper understanding of which approaches you might take.

There are several options for using OAuth 2 access tokens with multiple back-end resources (APIs) with single page applications or mobile applications. Read this post to discover how scope and audience are used to describe resources and how these different options might be implemented.