3 ms·
Username and password combo works. All these ceremonies around OAuth, passkeys, and magic links solved one problem but introduced two more. My job as a service
by rednafi 2y ago
Username and password combo works. All these ceremonies around OAuth, passkeys, and magic links solved one problem but introduced two more. My job as a service provider isn’t to coddle people who can’t be bothered to use a password manager.
Auth is the worst part of building a service and sucks all the fun out of it. API auth is a mess because people can’t keep a token string secret. Now we need JWTs, OAuth, token refreshing, and a whole bunch of BS that no one enjoys.
One reason why OpenAI and Anthropic APIs are so much more fun to use than Google and AWS offerings is that you get a token and are responsible for keeping it safe. It makes the entire workflow dead simple. I’m not creating a new project or fiddling with IAM just to try out an endpoint.
- tptacek 2y agoYour job as a service provider is, in fact, to minimize the likelihood that you will manage to communicate the passwords of your users to outsiders, because those passwords are very likely to be shared. That passwords should not be shared doesn't reduce your responsibility.