--- title: "Sam Critchley (@authagonal) | Hashnode" description: "The auth platform you migrate to. Read the latest articles by Sam Critchley on Hashnode." url: "https://hashnode.com/@authagonal" --- @authagonal # Sam Critchley @authagonal · Joined June 2026 The auth platform you migrate to. ### [The SCIM tax: provisioning is plumbing, not a premium](https://authagonal.hashnode.dev/the-scim-tax-provisioning-is-plumbing-not-a-premium?utm_source=hashnode&utm_medium=feed) SCIM is a standardized CRUD API whose most important verb is the one that turns an ex-employee's account off. Vendors price it at $125 a month per connection, or park it in the enterprise tier next to SSO. Here is what a SCIM connection actually costs to serve, and why charging for deprovisioning is charging for security. 4 min read · [authagonal.hashnode.dev](https://authagonal.hashnode.dev/the-scim-tax-provisioning-is-plumbing-not-a-premium?utm_source=hashnode&utm_medium=feed) [Jul 22](https://hashnode.com/posts/the-scim-tax-provisioning-is-plumbing-not-a-premium/6a6036789ecbeea70b3389a7) ### [Your password-reset form is a free email cannon](https://authagonal.hashnode.dev/your-password-reset-form-is-a-free-email-cannon?utm_source=hashnode&utm_medium=feed) An unauthenticated password-reset endpoint with no per-email rate limit is not just your problem. Point it at someone else's inbox and you have turned their reset form into a spam cannon, billed to your sender reputation. The fix, without leaking which emails have accounts. 4 min read · [authagonal.hashnode.dev](https://authagonal.hashnode.dev/your-password-reset-form-is-a-free-email-cannon?utm_source=hashnode&utm_medium=feed) [Jul 14](https://hashnode.com/posts/your-password-reset-form-is-a-free-email-cannon/6a56c78da8b1e5d630b7a69a) ### [Your backup quietly resurrects the users you deleted](https://authagonal.hashnode.dev/your-backup-quietly-resurrects-the-users-you-deleted?utm_source=hashnode&utm_medium=feed) Azure Table Storage and DynamoDB have no delete markers, so a deleted row just vanishes, which means your incremental backup never sees the delete at all. Restore that backup and the user you offboarded is back, with the password you rotated away from. Here is why deletes have to be first-class, and the one table that makes them so. 4 min read · [authagonal.hashnode.dev](https://authagonal.hashnode.dev/your-backup-quietly-resurrects-the-users-you-deleted?utm_source=hashnode&utm_medium=feed) [Jul 12](https://hashnode.com/posts/your-backup-quietly-resurrects-the-users-you-deleted/6a537ed437c5e87df71c5b1c) ### [We run a whole auth system on stores that only know get and put](https://authagonal.hashnode.dev/we-run-a-whole-auth-system-on-stores-that-only-know-get-and-put?utm_source=hashnode&utm_medium=feed) Azure Table Storage gives you a partition key, a row key, and almost nothing else. No joins, no secondary indexes worth the name, no increment. We run a multi-tenant auth system on it anyway. The patterns that make it work, and what you give up versus SQL. 6 min read · [authagonal.hashnode.dev](https://authagonal.hashnode.dev/we-run-a-whole-auth-system-on-stores-that-only-know-get-and-put?utm_source=hashnode&utm_medium=feed) [Jul 10](https://hashnode.com/posts/we-run-a-whole-auth-system-on-stores-that-only-know-get-and-put/6a50d85e7ccb2ab016519d35) ### [One hyphen, two tenants, one signing key](https://authagonal.hashnode.dev/one-hyphen-two-tenants-one-signing-key?utm_source=hashnode&utm_medium=feed) Two of our tenants were quietly the same tenant: same database, same token-signing key, different names. The cause was a one-line helper that sanitized slugs by stripping hyphens, turning a unique identifier into a non-unique one. Here's how a lossy string transform became a cross-tenant takeover, and why we found it before you did. 6 min read · [authagonal.hashnode.dev](https://authagonal.hashnode.dev/one-hyphen-two-tenants-one-signing-key?utm_source=hashnode&utm_medium=feed) [Jul 7](https://hashnode.com/posts/one-hyphen-two-tenants-one-signing-key/6a4d896be6305df7b8deb536)