Can a successful login reactivate a suspended organization membership?
A successful login should not reactivate a suspended organization membership.
EXPLORE THE FOUNDATIONS
Identity.
Authentication, sessions, and the people behind your application.
How should one user connect two accounts from the same OAuth provider?
Store each OAuth grant as a separate connection, bind jobs to its connection ID, and isolate token refresh, revocation, and reconnection per account.
When should a pending organization invitation consume a paid seat?
For most B2B products, do not let pending invitations consume paid seats permanently.
How do you stop an agent from connecting the wrong external account during OAuth setup?
The safe pattern is to treat OAuth setup as a bound installation transaction, not just a successful provider login.
How do we recover a customer workspace when its only owner is unreachable?
A practical recovery process for orphaned B2B workspaces using documented authority evidence, least-privilege reassignment, and Ory for identity and permissions.
Should a webhook receiver call downstream APIs using the webhook sender identity?
Verify the sender for event provenance, then usually call downstream APIs as your own service identity with separate tenant-scoped authorization.
How should login continue when a user leaves an in-app browser for their regular browser?
Design login handoff from an embedded browser to the user’s main browser without assuming shared cookies: when to restart, when to resume, and where Ory fits.
Should an enterprise trial become the production organization or create a new one?
Create a new production organization by default; promote a trial only after reviewing ownership, every member's access, and production data readiness.
Hardening OAuth device flow against phishing and code confusion
Treat the device code and user code as separate channels, then add confirmation, entropy, polling limits, and clear transaction context.
Can a company claim personal workspaces created with its email domain?
A verified company domain can identify likely employee-created workspaces, but it should not by itself transfer ownership of existing personal assets.
Should a household subscription use one shared login or separate identities?
Use separate identities for each person and model the household subscription as application-owned membership, with clear owner actions and recovery rules.
How should we evaluate managed identity for a product with short registration traffic spikes?
A practical way to assess managed CIAM for launch-day registration bursts: model starts, submissions, retries, and test limits, then verify vendor guidance.
Should a paid API encode subscription plans in OAuth scopes?
OAuth scopes should describe delegated API capability, not commercial plan state.
Prevent OAuth Mix-Up in Multi-Provider Login
Bind each OAuth authorization response to the issuer chosen at login start, and require `iss` when supported to stop shared-callback provider confusion.
Prevent Session Fixation at Login and Privilege Transitions
Rotate session identifiers at login, MFA, recovery, impersonation, and privilege changes, carrying forward only explicitly allowlisted anonymous state.
What should a user see after logging into an organization they have not joined?
Design a post-login flow for valid users who open an org deep link without membership, keeping authentication separate from org access and denying by default.
Stop machine accounts from becoming permanent orphaned access
Give every automation identity an owner, tenant, purpose, credential lifecycle, review schedule, and retirement trigger before it becomes orphaned access.
SameSite cookies through OAuth and federated login redirects
Trace callback method and site context before changing cookie policy so you can fix missing session or CSRF cookies without over-broadening them.
Should every customer record have a login identity?
No. Keep customer records independent from login identities, and create identities only when someone deliberately needs authenticated access.
Can a customer-hosted agent safely use a client secret shipped in your application?
A client secret shipped in customer-controlled software is not confidential. Design OAuth client authentication around the deployment trust boundary.
Refresh token rotation under retries, multiple tabs, and packet loss
Distinguish token theft from ordinary refresh races with token families, short grace rules, client coordination, and observable recovery.
Should the person paying for a SaaS subscription automatically own the organization?
Payment should not automatically grant organization ownership. Separate billing, contract, and product authority with explicit permissions and least-privilege access.
Treat a Primary Email Change as an Identity Migration
Use fresh authentication, two-address notifications, pending state, uniqueness handling, and recovery for primary email changes.
Propagate Identity Changes Without Shadow Profile Sprawl
Send minimal identity events and read current details on demand so downstream services copy only fields they truly own.
Should a suspended subscription prevent customer login?
A suspended subscription usually should not block authentication.
Can imported email addresses keep their verified status?
Preserve imported email verification only when its method, timestamp, unchanged address, and source meet current policy; reverify unclear records.
Do we need one OAuth client for every customer installation of a partner integration?
Use client-per-installation when you need independent revocation, attribution, or credential ownership; share a client only for uniform centrally operated installs.
Prevent account takeover when users link another identity
Link identities safely by proving control of the signed-in account and the new login method, rather than treating a matching email address as ownership.
Where should a SaaS product record acceptance of customer-specific terms?
Store customer-specific terms acceptance in application data keyed by person, organization, and exact document version.
Can we launch a partner API while keeping our existing website account system?
Keep existing website accounts and add an OAuth authorization layer for partner apps, with Ory Network as the managed integration path.
Can a service account be renamed without changing its permissions or audit history?
Use immutable machine subject IDs for service accounts and treat names as labels. That preserves permissions and audit continuity through renames and safe name reuse.
How should one account support separate public creator personas?
One account should represent the human owner, not the public pen name.
When is it safe to remove old login and recovery URLs after a migration?
Set practical retirement criteria for legacy login and recovery entry points after moving to Ory Network, including redirects, telemetry gates, and cutoff evidence.
Does a client-credentials integration need a refresh token?
Renew client-credentials access tokens with client authentication, bounded caching, and one coordinated renewal path instead of a refresh token.
When should a machine OAuth client use a signed assertion instead of a shared secret?
Use a signed client assertion when each workload can protect its own private key and you need stronger token-endpoint authentication controls than a copied shared secret provides.
Magic Links Under Replay, Forwarding, and Email Security Scanners
Design passwordless email login so automated URL inspection does not consume credentials and captured links cannot be reused.
How should an anonymous shopping cart become associated with a newly registered customer?
Associate a guest cart to a new account with an explicit post-registration claim transaction, backed by ownership checks, idempotency, and conflict handling.
What must be in the cache key for an OAuth token used by a multi-customer connector?
Cache OAuth tokens by authorization server, client ID, customer grant ID, resource or audience when applicable, and normalized effective scope.
OAuth redirect URI validation without wildcard surprises
Use exact registered redirects, constrained loopback handling, and explicit preview-environment patterns to prevent redirect and code-stealing flaws.
Should renaming an organization change its login URL?
Keep the login URL stable when an organization rebrands. Use immutable IDs underneath, treat readable slugs as aliases, and redirect old links safely.
What incident ownership should we agree on before adopting managed customer identity?
Define incident ownership before buying managed CIAM: who triages, what evidence crosses the handoff, and which failures stay with your app versus the identity provider.
Close the gap after SCIM deprovisioning
Treat directory deactivation as a revocation workflow across memberships, sessions, tokens, caches, jobs, shared resources, and failure recovery.
What should happen when a user declines an organization invitation?
A declined organization invitation should be recorded as a distinct invitation outcome, not treated as account deletion.
How can we measure signup drop-off without sending credentials or identity payloads to analytics?
Measure signup conversion with coarse journey events, short-lived correlation IDs, and strict redaction instead of sending credentials or identity payloads to analytics.
How do we migrate federated accounts when upstream subject identifiers change?
A safe migration pattern for federated identities when a provider issues different subject identifiers after a new app registration, with an Ory Network implementation approach.
Engineer a Safe Password-Reset Link Lifecycle
Handle retries, scanners, multiple requests, expiry, successful reset, and sessions as one recovery-state machine.
Should a browser app and its backend use the same OAuth client ID?
Usually no. Use separate OAuth client registrations when the browser and backend have different trust properties or terminate different parts of the protocol.
Should customers and external service providers share an account system in a marketplace?
For a two-sided marketplace, keep one human login but separate provider status, storefront permissions, and buyer records into distinct domain objects.
Should a customer be allowed to create multiple accounts for different personal contexts?
Choose separate customer accounts only when people need real isolation in discovery, recovery, or policy. Otherwise keep one identity and model contexts as profiles or roles.
Step-up authentication with acr and amr claims
Require stronger authentication for one sensitive transaction without confusing requested assurance with methods actually used.
How do we delete a login account without accidentally deleting records the business must retain?
Delete login access separately from retained invoices, audit trails, and business records, using internal IDs and explicit retention and anonymization workflows.
Harden the OAuth Callback in a Single-Page Application
PKCE is one control; a safe SPA callback also binds state, issuer, redirect, storage, and one-time processing.
Design OAuth grants for automation that outlives a user session
Design long-running OAuth automation by separating delegated user access from organization-owned workload identity, with explicit scope, audience, and revocation rules.
Should customers be able to see which other organizations a user belongs to?
For competing-customer B2B apps, keep customer-visible membership data scoped to the current organization.
Should missing profile fields prevent account creation or be collected after login?
Usually collect nonessential profile fields after login; block account creation only for security-, legal-, or immediately action-critical data.
Should customers still be able to log in after their subscription expires?
Yes—usually they should still be able to log in, but not continue normal paid work.