MojoAuth BlogPasswordless Authentication and Identity
Passwordless authentication, passkeys, CIAM and identity security: guides, analysis and product news from the MojoAuth team.
1,077 posts27 authorssince 2021RSS
- Nov 12, 2026 · Gopal GehlotAutomatic SMS Code Entry on Android: The SMS Retriever API, Correctly
- Nov 11, 2026 · Gopal GehlotThe Auth Change Freeze Before Black Friday: What to Freeze, What to Tune, Who Watches
- Nov 10, 2026 · Gopal GehlotEmail OTP Latency: What to Measure, and Why Your Averages Are Lying
Topics
Latest
Nov 9, 2026 · Gopal GehlotIndia's DPDP Consent Managers From 13 November 2026: What Changes at Signup, and What Is Due by May 2027On 13 November 2026 India opens consent manager registration. Your signup duties under the DPDP Act start on 13 May 2027. What each date switches on.
Nov 6, 2026 · Gopal GehlotWeb Bot Auth at Login: How to Verify Signed Agents and Route Them Apart From Unknown BotsVerify Signature-Agent and the key directory at your login endpoint, with tested code, and route verified, invalid and unverified agents onto three paths.
Nov 5, 2026 · Gopal GehlotBulk Sender Requirements and Your Login Email: What Applies and What Does NotGoogle's sender guidelines never use the word transactional. The requirements split by volume, not by message type — with exactly one exception.
- Nov 5, 2026Black Friday & Cyber Monday 2026: Passwordless Login and Developer Tool DealsVerified Black Friday and Cyber Monday 2026 deals on passwordless login and developer tools, plus 20% off MojoAuth with code BF2026.
Nov 4, 2026 · Gopal GehlotDevice Bound Session Credentials (DBSC) for Consumer Apps: Registration, Refresh and the Cookie You Must Stop AcceptingHow to add DBSC registration and refresh endpoints so a stolen session cookie expires in minutes, which status codes end a session, and what DBSC does not stop.
Nov 3, 2026 · Gopal GehlotWhy Your Magic Link Lands in Spam: SPF, DKIM and DMARC for Login EmailThe three records answer three different questions, and none of them is whether your email is legitimate.
Nov 3, 2026 · Dev KumarHow Physical AI Companies Build Secure and Reliable AI SystemsHow physical AI companies secure robots, drones and autonomous systems: secure boot, device identity, access control, fail-safe design, signed OTA updates and lifecycle security.
Nov 2, 2026 · Gopal GehlotRefresh-Only DPoP in a Browser App: WebCrypto Keys, DPoP-Nonce and RotationHow to bind a browser app's refresh token with DPoP while access tokens stay Bearer: non-extractable WebCrypto keys, the DPoP-Nonce retry loop and CORS.
Oct 31, 2026 · Dev KumarHow Generative AI Is Expanding the Endpoint Attack SurfaceLearn how generative AI is expanding the endpoint attack surface through AI agents, shadow AI, prompt injection, and new identity and privilege risks.
Oct 30, 2026 · Gopal GehlotPasskey Downgrade Attacks: How Phishing Proxies Push Users to the FallbackA phishing proxy cannot relay a passkey, so it hides the passkey and phishes the password or OTP fallback.
Oct 29, 2026 · Gopal GehlotWhen WhatsApp OTP Is the Wrong ChannelMeta's own guidance is not to make WhatsApp your default code delivery method.
Oct 28, 2026 · Gopal GehlotOAuth Client ID Metadata Documents (CIMD) Explained: Fetch, Validate, CacheHow an authorization server fetches, validates and caches a Client ID Metadata Document without becoming an SSRF proxy.
Oct 27, 2026 · Gopal GehlotWhatsApp OTP vs SMS OTP: Delivery, Cost and Country CoverageWhatsApp bills authentication as its own category, discounts it by monthly volume, and then permanently raises it in nine countries once you get big.
Oct 26, 2026 · Gopal GehlotConsent Phishing Account Takeover: Why a Password Reset Leaves the Attacker InOAuth consent phishing gives an attacker a grant, not a password, so a reset does not end it.
Oct 26, 2026 · Dev KumarDedicated Servers vs. Cloud Hosting: Which Is Better for Secure Web Applications?Dedicated servers give you isolation, steady performance and clear data residency; cloud hosting gives you elastic scale.
Oct 26, 2026 · Dev KumarHow Students Can Protect University Accounts From Phishing AttacksPhishing emails hit students hardest during enrollment, finals and financial aid season.
Oct 23, 2026 · Gopal GehlotWhatsApp OTP: How the Authentication Message Template Actually WorksThe body text is fixed, the code is the only variable, and the delivery mechanic changes by platform.
Oct 22, 2026 · Gopal GehlotFIDO Passkey Index October 2026: What the Numbers Mean for Your Roadmap36% of sign-ins, 42% of eligible accounts, 93% vs 78% success: what the October 2026 FIDO Passkey Index measures and what it changed from 2025.
Oct 19, 2026 · Dev KumarHow to Choose a Cloud Migration Partner for Authentication-Heavy ApplicationsA cloud migration can look healthy on the dashboard while customers can't sign in.
Oct 16, 2026 · Dev KumarWhen Authentication Workloads Need Dedicated ServersPassword hashing is tuned to be expensive, so shared cloud CPUs make its timing a moving target.
Who writes here
All authors →Ready to go passwordless?
Add passkeys, magic links, OTP and social login to your consumer app with one API.