FAPI is a security profile that protects APIs in high-value scenarios that require heightened security. To be considered FAPI 2.0 compliant, an implementation must adopt the right set of OAuth best…

Duende Software's legendary training on Identity and Access Management was originally created by Dominick Baier and Brock Allen. With their world-class knowledge, they’ve created a workshop focused…

A strategic architecture guide for migrating from IdentityServer3 to Duende IdentityServer, covering compliance risks, cost drivers, code archaeology, and execution steps for a successful identity…

Duende Software is a company that builds industry-leading security software.

An accessible explainer of TOTP (the algorithm behind those six-digit authenticator codes) covering how it works, its role in MFA, and Duende's built-in support.

Overview of Duende IdentityServer framework for OpenID Connect and OAuth 2.x protocols, covering extensibility, security scenarios, licensing, and support.

In this video, we continue our Duende web application security series with a deep dive into HTTP Strict Transport Security (HSTS). HSTS is a crucial security mechanism that enforces the use of HTTPS…

The MCP 2026-07-28 release candidate tightens OAuth security for AI agents. Analyze the spec changes and implement them with Duende IdentityServer.

Before writing code, every team needs to answer what identity means for their organization. Learn the core vocabulary—authentication, authorization, claims, tokens, federation—and the critical…

The MCP 2026-07-28 release candidate tightens OAuth security for AI agents. Analyze the spec changes and implement them with Duende IdentityServer.

A practical guide to choosing session and token lifetimes in Duende IdentityServer. Learn how to align your security configuration with your specific risk profile instead of relying on defaults.

A breakdown of six new OAuth security enhancements in the latest MCP release candidate, covering DCR application types, issuer identification, discovery clarifications, credential binding, refresh…

In this episode, we explore how to enforce transport security in your web applications by ensuring HTTPS is used throughout your ASP.NET Core project. Topics covered in this video: - Using…

Learn how to implement passkeys and WebAuthn with Duende IdentityServer and User Management, including progressive onboarding patterns and deployment considerations.

OpenID Connect may be the standard of tomorrow, but SAML is the bedrock of today’s enterprise. Mastering this legacy giant isn’t just about maintenance; it’s the essential gateway to high-value…

This isn't a point release. This is a new chapter. On June 2, Duende ships the most significant release in the company's history: IdentityServer v8 - a .NET 10-exclusive major release, five modular…

How to configure Duende IdentityServer to wrap auto-managed signing keys in X.509 certificates, enabling unified SAML and OIDC key rotation with a single configuration change.

A prioritized 10-step checklist for developers who have inherited a running Duende IdentityServer, covering license verification, Data Protection, signing keys, stores, client inventory, and…

This isn't a point release. This is a new chapter. On June 2, Duende ships the most significant release in the company's history: IdentityServer v8 - a .NET 10-exclusive major release, five modular…

Duende Software is a company that builds industry-leading security software.

How to integrate the HaveIBeenPwned API with Duende User Management's IPasswordValidator pipeline to reject known-compromised passwords during registration, using k-anonymity to preserve user privacy.

Duende Software is a company that builds industry-leading security software.

Duende Software is a company that builds industry-leading security software.