The Authr Journal

Notes on holding the keys

Engineering deep-dives, launches, and opinions about identity — written by the people who operate it, since 2022.

20261 post

The architecture decisions, near-misses, and cell migrations behind growing authentication volume forty-fold in four years without an SLA breach.

20251 post

How a company whose product must not go down learns from the times it almost does, without burning the people involved.

20242 posts

A tour of Authr's internal PKI: why public CAs were the wrong tool, and what running our own actually requires.

How Authr rotates token signing keys under live traffic, and why the hard part is everyone else's cache.

20231 post

A six-month latency hunt through signing queues, cold caches, and one shameful mutex, measured at the p99 where users actually live.

20221 post

A field guide to how single sign-on fails in the wild, drawn from the incidents we see across hundreds of IdP integrations.