11posts
Anthropic’s Zero Trust for AI Agents gets the direction right and writes down the test that decides it: impossible, not tedious. A walk through where the framework stops, and where an agent-native authorization substrate has to begin.
The Hellō Admin MCP Server I recently watched Andrej Karpathy deliver a talk on Software 3.0, where he talked about coding in English, and notably expressed frustration with setting up authentication 😖. Inspired to address this issue (and to try out coding in English), I began experimenting with the Model Context Protocol (MCP) to enable the creation […]
August 4, 2025 Update We have migrated to the tenant claim that is what was org.id and no longer include the domain. See our updated documentation. With the release of our B2B SaaS functionality, we needed a mechanism to communicate which organization a user belongs to. A domain name is a common human memorable identifier for an organization, just […]
Why we are moving away from UUIDv4 Updated July 1, 2024 – we will continue to provide UUIDv4 identifiers to our existing customers. Identifiers are a foundational component of any computing system, and key to an identity service. At Hellō, we have: We of course don’t have control over external identifiers. Our requirements for our […]
Adding auth to your app has never been this easy Tl;dr: Test drive the sample code https://github.com/hellocoop/hello-nextjs-sample/ In the video below, we walk through test-driving the sample repo: We then add Hellō to one of the Next.js sample apps per this post: Note the pointer to the clock so you can see the true elapsed time! See the blog […]
In our mission to reduce developer friction, we looked at what we could do to simplify adding Hellō to your app. Running the commands below will create a Next.js sample app, add Hellō, and open up a sample page for you to log in — try it out! To add Hellō to your app, cd to your […]
I have configured the popular social login providers for numerous applications over the years. Despite knowing a few things about identity, I find the configuration process tedious and confusing, and when talking to other developers, they have similar complaints. We strive to simplify login and registration at Hellō, and question why you need deep expertise in OAuth and […]
A challenge when developing against any of the large Social Login providers such as Google is that for security reasons[1], they don’t support using http://localhost, which makes doing local application development that uses these providers challenging. At Hellō, we strive to simplify adding identity to your applications. To enable localhost development, we separated redirect URIs to be either […]
Verify Who Your Users are on Other Services You can now include discord, github, gitlab, and twitter in your authorization requests and Hellō will ask the user to link and select the requested provider(s) to provide you with a verified claim of their identifiers on those services. As usernames can be changed, we provide both the username, and the permanent id from the […]
May the Fourth be with You – Passkey Support now in Beta Not only is it Star Wars Day, but it is also International Password Day. Expect lots of announcements about passkeys today as the prevailing wisdom is that the best password is no password, and passkeys have emerged as the shiny new replacement. Despite […]
Control Which Providers are Recommended to Your Users As we have added to our list of login providers, new users were staWith this update, you can override which providers are recommended to your users by setting the provider_hint query parameter in the authorization URL. For example, if you want to add GitHub and remove email and Apple […]