Aaron Parecki

19 May

my head feels like a blender that has been filled past the "do not fill above" line

kylegabriel.comAutomated Hydroponic System Build – Projects | Kyle Gabriel

30 Mar

Found my todo list for 2026 kylegabriel.com/projects/202...

30 Mar

TIL about UIScreenshotService which enables iOS apps to provide a high res PDF screenshot of the app content when the user uses the system screenshot action! Chrome uses this to give a full export of the page!

25 Mar

I'm impressed, Cathay Pacific transferred my vegetarian meal request to the new flight they moved me to after the incoming flight was late and missed the connection. Normally airlines say oh well you didn't reserve the meal 72 hours before the flight.

8 Mar

Happy final Daylight Savings Time Eve to all our friends in British Columbia! I hope we can join you on the other side soon!

6 Mar

I'm setting up a temporary laptop for my next trip and it's shocking how much faster the cross-device passkey flow is compared to looking up and hand typing my long 1Password passwords

13 Feb

Inspired by some #indieweb folks creating /caw pages on their websites, I made one of my own! Here you can listen to the most recent crow recorded from my house: aaronparecki.com/caw/

Apparently I missed the introduction of the 4.4mm TRRRS audio jack 10 years ago and just now discovered it. What a cool idea.

13 Jan

"I'll just check my critical thinking and nuke it in the microwave" has to be my favorite quote from this Business Insider video on Trader Joe's white-labeled food

13 Jan

Oh crap I just realized the "it" he was referring to was probably the food, not his critical thinking.

12 Jan

Me looking at my todo list on a Sunday night after having done at least a couple things today, yet somehow it looks more like a list of what I did *not* do today.

17 Dec 2025

oh no, due to a series of misclicks, I just accidentally archived the most recent 100 emails in my inbox. if nothing else, reviewing my "all mail" folder is doing a good job of making me question how important emails in my inbox actually are.

25 Nov 2025

The new MCP spec just dropped! 🎉 There's too many new things to get into everything, but there are two big changes I am most excited about 👀 📝 Client ID Metadata Documents (CIMD) - a simpler way to manage client registrations, clients describe themselves with a URL they control

aaronparecki.comClient Registration and Enterprise Management in the November 2025 MCP Authorization SpecThe new MCP authorization spec is here! Today marks the one-year anniversary of the Model Context Protocol, and with it, the launch of the new 2025-11-25 specification. I’ve been helping out with the ...

25 Nov 2025

🔐 Enterprise-Managed Authorization extension (aka Cross App Access) - eliminate the OAuth redirect and get tokens for an MCP server by requesting them from the enterprise IdP Read more about what these mean for you in my full post 👉 aaronparecki.com/2025/11/25/1...

aaronparecki.comAdding Support for BlueSky to IndieLogin.comToday I just launched support for BlueSky as a new authentication option in IndieLogin.com!

I just finished adding BlueSky support to IndieLogin.com! Now you can log in to websites like indieweb.org with your BlueSky handle!

The IETF OAuth Working Group has adopted the Client ID Metadata Document specification! > This specification defines a mechanism through which an OAuth client can identify itself to authorization servers, without prior dynamic client registration or other existing registration.

This could replace Dynamic Client Registration in MCP, dramatically simplifying management of clients, as well as enabling servers to limit access to specific clients if they want.

cimd.devCIMD - OAuth Client ID Metadata DocumentsLearn about Client ID Metadata Documents (CIMD) - a new OAuth approach that lets clients identify themselves using URLs instead of preregistration. Presented by Stytch.

The folks at Stytch put together a really nice explainer website about it too! cimd.dev

The mechanism of clients identifying themselves as a URL has been in use in IndieAuth for over a decade, and more recently has been adopted by BlueSky for their OAuth API.

The recent surge in interest in MCP has further demonstrated the need for this to be a standardized mechanism, and was the main driver in the latest round of discussion for the document!

Clients identify themselves with their own URL, and host their metadata (name, logo, redirect URL) in a JSON document at that URL. They then use that URL as the client_id to introduce themselves to an authorization server for the first time.

datatracker.ietf.orgIdentity Assertion Authorization GrantThis specification provides a mechanism for an application to use an identity assertion to obtain an access token for a third-party API by coordinating through a common enterprise identity provider us...

The IETF OAuth Working Group has adopted the Identity Assertion Authorization Grant specification! datatracker.ietf.org/doc/draft-ie... This is the basis of Cross App Access (XAA), providing IT admins better visibility and control by configuring the app-to-app connections in their enterprise IdP.

While it will still be a while before it is an RFC, this is an important step in the standards process, as this is the first time the document is "official"! This signifies that the working group agrees that the problem is worth solving, and agrees on the general direction of the spec.

Thanks to everyone for your contributions and feedback so far! And thanks to my co-authors Karl McGuinness and Brian Campbell!

datatracker.ietf.orgDPoP for the OAuth 2.0 Device Authorization GrantThe OAuth 2.0 Device Authorization Grant [RFC8628] is an authorization flow for devices with limited input capabilities. Demonstrating Proof of Possession (DPoP) [RFC9449] is a mechanism to sender-con...

Inspired by a question from @thisismissem.social, I wrote up a document describing how to apply DPoP (RFC9449) to the OAuth Device Flow (RFC8628). datatracker.ietf.org/doc/draft-pa...

5 Aug 2025

Well that's the last time I take my ID out of my wallet to go through airport security. I made the mistake of putting it into my pocket instead of back in my wallet and it seems to have fallen out somewhere between PDX and SFO 🫠

It has come to my attention that I have previously loaded my passport into my Android phone as an "ID pass" which should theoretically get me through TSA legitimately

6 Aug 2025

Update: it worked! I only had to tap my phone and I got through TSA!

At least I have CLEAR right now so I should be able to get home without an ID.

5 Aug 2025

Maybe some day Oregon will get on the mDL bandwagon and I won't need to rely on this silly piece of plastic anymore

30 June 2025

I just got FreePBX up and running and connected to a WiFi phone and my doorbell and video intercom system! I have two way calling between every device, I can even connect analog phones!

30 June 2025

What shenanigans should I rig up next? I'm thinking maybe an old payphone at the street, or maybe an old 1920s style phone for the speakeasy...

The latest version of the MCP spec is now officially 2025-06-18! Congrats to everyone in the MCP community involved in making this happen! Key updates to the authorization section 👇

🔍 RFC9728 Protected Resource Metadata enables the MCP client to dynamically discover the MCP Server's authorization server 👉 RFC8707 Resource Indicators are required as a security measure

Thanks to everyone who contributed to the many discussions to update the authorization part of the spec to be more compatible with existing OAuth systems!

The latest version of the MCP spec is now officially 2025-06-18! Congrats to everyone in the MCP community involved in making this happen! Key updates to the authorization section 👇

⚙️ MCP Servers are no longer responsible for issuing access tokens or handling user authentication 🛡️ A dedicated Authorization Server separate from the MCP Server handles user authentication and issuing access tokens

5 June 2025

TIL the point up emoji ☝️ doesn't work as a reaction on iMessage because Apple displays the emoji above the message it's a reaction to 😂

mcpdevsummit.aiMCP Developers Summit - San Francisco - 2025

9 May 2025

In two weeks I'll be speaking at @mcpdevsummit.bsky.social in San Francisco! MCP has quickly reshaped how developers are building AI agents. My talk "Intro to OAuth for MCP Servers" will cover the basics of the MCP authorization protocol and set the stage for building secure MCP servers.

Aaron Parecki reposted

MCP Developers Summit

@mcpdevsummit.ai

2 May 2025

🎤 Speaker Spotlight: Aaron Parecki, Director of Identity Standards at @okta Learn how #OAuth applies to #MCP servers and why securing your #MCP server is critical To attend this session and more register at buff.ly/NzqdbNE @aaronpk.com #AI #LLM #ModelContextProtocol #MCPDevSummit

14 Apr 2025

oh no I just realized tomorrow is Monday

2 Apr 2025

Is it just me or does this current Model Context Protocol wave remind anyone of the early Web 2.0 days of everyone launching open APIs?

28 Mar 2025

I've got 22 hours in Hong Kong on a layover and I'm staying overnight in a hotel near the old Kowloon Walled City. Any tips for what I should do on this very short trip?

28 Mar 2025

The building that collapsed from the earthquake was right next to the train station we got off at when we arrived in Bangkok last weekend. We took the train from Chiang Mai to Chatuchak 😮

maps.app.goo.gl/YUANzTLHUfCZ...

28 Mar 2025

maps.app.goo.glGoogle MapsFind local businesses, view maps and get driving directions in Google Maps.

16 Feb 2025

Chase sends 8-digit 2fa SMS codes, which seems excessive compared to the 6 that most other places use, but even weirder is that the first digit of them has always been the same, effectively making it a 7 digit code. Anyone know what's up with that?

rfc-editor.orgRFC 9700: Best Current Practice for OAuth 2.0 SecurityThis document describes best current security practice for OAuth 2.0. It updates and extends the threat model and security advice given in RFCs 6749, 6750, and 6819 to incorporate practical experience...

4 Feb 2025

At long last, the OAuth working group has finished the Best Current Practice for OAuth 2.0 Security and it was just published as RFC9700! This has been a long time in the works, and I'm very thankful to everyone who has helped out with it over the years! www.rfc-editor.org/rfc/rfc9700....

4 Feb 2025

This is one of the major inputs to OAuth 2.1, so I'm also very excited to be able to move that forward this year as well!

3 Feb 2025

Every now and then I remember how in 2014 I mined $20 worth of dogecoin, then said this is stupid and exchanged it for 0.05 bitcoin sent to a brainwallet. I can't remember the seed phrase, so it's just stuck in the blockchain, and is now worth $5000