Architecture and DesignTOGAF, DDD, target-state, strangler-fig, C4, ADRs — not a glossary, a sequence.15 min read·shubhankarsarkar.hashnode.devSep 12
Onboarding a Partner to Your API: A Step-by-Step Entra RunbookPart 6 of 6 in the Entra ID Authentication: A Field Guide series. Every article on this topic explains the pieces. Very few say what order to do them in, or what you actually put in the email to the p17 min read·shubhankarsarkar.hashnode.devSep 12
Validating Entra Tokens in Azure API ManagementThe validate-jwt policy, client certificates, and the v1/v2 issuer trap that costs everyone an afternoon.5 min read·shubhankarsarkar.hashnode.devSep 12
Secretless Azure: Managed Identities and Workload Identity FederationWhy a secret in Key Vault is not the answer, and what to use instead.9 min read·shubhankarsarkar.hashnode.devSep 12
OAuth 2.0 Grant Types in Azure: Which to Use, and Which Are DeadAuthorization code with PKCE, client credentials, on-behalf-of — and the two flows to stop reaching for.6 min read·shubhankarsarkar.hashnode.devSep 12
