Database

API key generation, hashing, rotation, scoping, and rate limiting patterns

JWT creation, validation, refresh token rotation, and secure token storage patterns

Multi-tenant authentication isolation, tenant-scoped tokens, and data boundary enforcement

OAuth 2.0 authorization code, PKCE, client credentials, and token exchange patterns

Passkeys and WebAuthn implementation for passwordless authentication

Role-based access control design, permission hierarchies, and enforcement patterns

Server-side session handling, cookie security, session stores, and fixation prevention

SSO and SAML integration for enterprise identity federation and service provider setup