Blog · 12 posts
From the Thoryn team
Deep dives on enterprise IAM, OAuth 2.1 / OIDC, and EU-first identity infrastructure.
- engineering
- cli
- graalvm
Single-binary CLI — GraalVM, picocli, and the Kotlin reflection trap
thoryn ships as a 30-MB native binary that starts in 30 ms. Getting picocli + Kotlin + GraalVM to cooperate took one fix the picocli docs do not warn you about.
24 Jun 2026 · Mark Bakker
- architecture
- oauth2
- bff
One hostname, two backends — the BFF pattern, properly
The console talks to the BFF, the BFF talks to the gateway — both behind one hostname so cookies stay first-party and refresh tokens never reach the browser.
17 Jun 2026 · Mark Bakker
- oauth2
- security
- mtls
mTLS client auth and cert-bound tokens — OAuth2 for workloads, not browsers
OAuth2 was invented for the browser. RFC 8705 retrofits it onto workloads — service meshes, financial counterparties, partner integrations. Here is what shipped and why it matters for B2B.
10 Jun 2026 · Mark Bakker
- oauth2
- security
- dpop
Bearer is not enough — DPoP token binding (RFC 9449)
Bearer tokens are bearer. Whoever holds one is the user. DPoP swaps that for "whoever holds the keypair the token is bound to" — same OAuth flow, very different threat model.
3 Jun 2026 · Mark Bakker
- iam
- gdpr
- eu
Self-hosted, EU-only IAM in 2026
Why EU-incorporated companies are moving their identity stack off US-hosted SaaS — and what that looks like in practice.
1 Jun 2026 · Mark Bakker
- oauth2
- engineering
- architecture
PAR (RFC 9126) and why state belongs in Redis from day one
PAR is the moment in OAuth where the client says "hold this for me" and the server returns an opaque handle. The catch — that handle has to resolve on a different pod than the one that minted it.
27 May 2026 · Mark Bakker
- security
- oauth2
- fapi
FAPI compliance — what we actually implement
FAPI-compliant is on a lot of vendor sites. Here is what FAPI actually requires, the three protocols we ship — PAR, DPoP, mTLS — the test that proves it, and the parts we do not claim yet.
20 May 2026 · Mark Bakker
- architecture
- oauth2
- federation
The federation broker pattern — why our authorization hub has no User entity
A pure broker issues tokens but stores no users. Identity-service owns Thoryn-managed users; enterprise IdPs own enterprise users. Here is what it took to enforce in code, schema, and conventions.
13 May 2026 · Mark Bakker
- positioning
- market
- identity
$82 billion, three targets — identity is one of them
Cybersecurity M&A hit $82 billion in 2025. Hogenhouck names AI, cloud security, and IAM as what acquirers want. Here is why platform beats feature in this consolidation cycle.
8 May 2026 · Mark Bakker
- engineering
- oauth2
- architecture
Stateless by design — an OAuth2 server that holds zero user state
Most authorization servers store sessions, tokens, and credentials. Ours stores none of them. Here is what moved where, and what we gave up for it.
6 May 2026 · Mark Bakker
- security
- engineering
- pre-prod
What we found before shipping — a pre-prod cleanup story
Most vendors say they harden it before launch. We wrote the list. Nine dev shortcuts caught and filed before the customer plane went near production traffic, plus the rule we used to find them.
26 Apr 2026 · Mark Bakker
- engineering
- platform
- content
Why we picked MDX-in-repo for our blog
Headless CMS or MDX files in git? We chose MDX. Here is the reasoning, the trade-offs, and what a post actually looks like end-to-end.
25 Apr 2026 · Mark Bakker
