// Track

Authentication Architecture

From Cookies to OAuth to Cross-Domain Sessions

How authentication ACTUALLY works — from cookies to OAuth to cross-domain sessions. Every lesson uses a real production debugging journey as the running example: the April 2026 incident that took 12 PRs and 8 hours to resolve.

8 lessons~52 min total

Lessons are shown in recommended order. Complete them in sequence for the best experience — or jump to any lesson.

Lesson 249·6 min read

Authentication Fundamentals — Sessions, Tokens, and Cookies

HTTP is stateless. Sessions, cookies, and tokens are how we fake memory into it. Understanding the mechanics — and the tradeoffs — is the foundation of every auth system you will ever build.

Lesson 250·6 min read

OAuth 2.0 — The Authorization Dance

OAuth exists because sharing passwords is catastrophic. The authorization code flow, tokens, scopes, and redirect URIs — the full mental model behind every 'Login with Google' button you have ever clicked.

Lesson 251·6 min read

PKCE — Why Modern Apps Don't Use Implicit Flow

The Implicit flow put access tokens in URL fragments — visible in browser history and referrer headers. PKCE replaced it with a cryptographic handshake that works without a client secret. One config line brought down 8 hours of debugging.

Lesson 252·6 min read

Supabase Auth — GoTrue Under the Hood

Supabase doesn't do auth — GoTrue does. Understanding this open-source OAuth middleware layer explains every mysterious redirect, every configuration setting, and why your callback URL matters so much.

Lesson 253·7 min read

Server-Side vs Client-Side Auth — Static Sites Can't Do OAuth

A static export has no server — no middleware, no API routes, no server-side code. That architectural fact made 8 separate OAuth implementation attempts fail. Here is why, and what actually works.

Lesson 254·7 min read

Cross-Domain Authentication — The Google Model

Google has one auth hub at accounts.google.com. A cookie on .google.com makes Gmail, Drive, and YouTube all know who you are. After 12 PRs and 8 hours of debugging, this is the architecture we built for jeremyknox.ai.

Lesson 255·6 min read

Identity Linking — One User, Multiple Login Methods

Discord creates user A. Email creates user B. Same person, two accounts. Supabase's identity linking solves this in 15 lines. The custom implementation we replaced was 80 lines. Here's the state machine.

Lesson 256·8 min read

Production Auth Checklist — Everything That Can Go Wrong

Env vars that silently don't reach Production. Redirect URIs that must match exactly. Tokens that exceed 4KB. Two clients racing for the same lock. The complete diagnostic playbook from 8 hours of production debugging.