JJaden Vo3h ago · 8 min readHow Authenticator-App 2FA Codes Actually Work: Build a TOTP Generator in ~30 Lines (and Why It Beats SMS)TL;DR: An authenticator-app code is just HMAC-SHA1(secret, floor(unix_time / 30)), chopped down to 6 digits. The spec is RFC 4226 (HOTP) plus RFC 6238 (TOTP), and the whole algorithm fits in about 30 11Ajadenvo259.hashnode.dev
RRONI DAS20h ago · 10 min readFollow One OAuth Token From Birth to Expiry, and Most Interview Questions Answer ThemselvesWhy does the authorization server hand your app a code, and not the token it actually wants? If you can answer that in two sentences, you can answer about half of the OAuth questions an interviewer wisystemdesignacademy.hashnode.dev
SSonu Singh21h ago · 5 min readAccess Token vs Refresh Token: What I Finally UnderstoodI use tokens in almost every app I build as a Flutter developer. Login works, API calls work, so I never stopped to ask why we need two tokens. Why not just one? Recently I watched a lecture on this tsonusinghdev.hashnode.dev
CCruxtab Technologies Pvt. Ltd.1d ago · 3 min readMaintaining Authorization Metadata Across Shopify App ChangesAs a Shopify app evolves, it may request different API permissions to support new functionality or changes to existing features. Managing those permission changes involves more than updating the app'scruxtab-technologies.hashnode.dev
VVeloCMS2d ago · 20 min readHow do I build a membership site?Start by deciding what members actually pay for (posts, a community, courses, a tool), then pick one of four routes: a hosted membership or community platform, a CMS with memberships built in, a CMS pvelocms.hashnode.dev
NnRouter.ai2d ago · 2 min readOne Key Per Job: Per-Key Budgets, Rate Limits, and Audit Trails in nRouterThe most common API key setup in production is also the worst: one shared key, used by every service, every environment, and every teammate, with no way to answer the question "which system made this nrouter.hashnode.dev
MMUQTADIRMALIK QUAZI2d ago · 5 min readWho can reach your workspace? Context-based ingress in Azure DatabricksIP access lists only ask “where are you coming from?” Context-based ingress in Azure Databricks also asks who you are and what you’re trying to do for public traffic and, as of October 2026, for Privamuqtadirmalik.hashnode.dev
SSignOps3d ago · 3 min readEmail OTP vs SMS OTP: cost, delivery and securityBoth send a short code the user types back. They differ on cost, setup, delivery and what an attacker needs to steal one. Side by side SMS OTP Email OTP Cost each in India About Rs 0.13 to Rs 0signops.hashnode.dev
RRoland Mweze3d ago · 33 min readHow to Build Passkey Authentication with WebAuthn, Next.js and NestJSPasswords are a pain for both users and service providers․ Users often find it difficult to remember passwords, and the risk of phishing and password reuse across multiple websites is high. Developers2freecodecamp.org
AAmit Shukla3d ago · 6 min readHow your 2FA app makes the right code with no internet: TOTP explainedPut your phone in airplane mode and open Google Authenticator, Authy or 1Password. The six digit codes keep changing every 30 seconds, and they still work when you type them into GitHub. Your phone neamitshuklabag.hashnode.dev
