Blog — Alter | OAuth, AI Agents, and Authorization

Blog

Engineering notes on OAuth, AI agent security, and authorization architecture.

March 18, 2025

Alter Raises $4.8M Seed Round Led by Fortify Fund

We're announcing our $4.8M seed round to build the authorization layer that agentic AI has been missing since the first multi-agent system shipped a raw OAuth token in a plain-text config file...

March 15, 2025

Alter Raises $4.8M Seed Round to Build OAuth Infrastructure for AI Agents

Today Alter closes a $4.8M Seed Round led by Fortify Fund. This is the funding we needed to finish building the authorization layer that agentic AI has been missing...

March 10, 2025

OAuth Token Sprawl Is the Security Debt Nobody Talks About

Six months after your first multi-agent deployment, your OAuth token inventory is a mess. Here's why it happens and how to stop it before it becomes a breach story...

March 8, 2025

The OAuth Threat Model for AI Agents

AI agents exploit OAuth in ways the protocol was never designed to handle. A structured threat model covering the eight attack surfaces that matter in 2025...

March 3, 2025

Minimum Privilege for AI Agents: Why OAuth Scopes Aren't Enough

Standard OAuth scopes are too coarse and too static for agentic workloads. The principle of least privilege needs a different implementation for AI agents...

March 1, 2025

Why Token TTL Matters More Than Scope for AI Agent Security

Most teams focus on scope when locking down AI agent credentials. Token lifetime is the more important variable. Here's the data behind that claim...

February 24, 2025

Connecting LangChain Agents to Alter in 15 Minutes

A concrete walkthrough of wiring a LangChain tool agent to use Alter for all OAuth credential requests. One config change, no agent code changes required...

February 22, 2025

Credential Sprawl Is the Silent Risk in Agentic AI

Credential sprawl in AI pipelines happens invisibly and compounds fast. How to detect it, measure it, and stop it from becoming your next security incident...

February 17, 2025

OAuth 2.1 Is Here. What Actually Changed for Agent Developers?

OAuth 2.1 removes implicit flow, mandates PKCE, and tightens redirect URI matching. For agent developers, two of those three changes matter a lot...

February 15, 2025

Minimum Privilege for AI Agents Is Harder Than It Looks

The principle of minimum privilege is easy to state and difficult to implement for AI agents. Here's why standard approaches fail and what actually works...

February 10, 2025

Why HashiCorp Vault Doesn't Solve the AI Agent Credential Problem

Vault is excellent at static secrets management. AI agents have a different credential lifecycle that Vault wasn't built for...

February 8, 2025

Getting Useful OAuth Audit Logs Into Your SIEM

OAuth audit logs from standard providers tell you almost nothing about what your AI agents actually did. Here's how to enrich them into actionable security telemetry...

February 3, 2025

Building an AI Agent Audit Trail That Holds Up in a Security Incident

When your agent causes a security incident, "the agent did it" is not an acceptable incident report. Here's what a useful audit trail actually looks like...

February 1, 2025

GitHub OAuth and AI Agents: What Actually Goes Wrong

GitHub is the most common OAuth integration for AI agents and the most commonly mishandled. A technical walkthrough of the four failure patterns we see most often...

January 27, 2025

Credential Delegation in CrewAI: How Alter Handles Multi-Agent Hierarchies

When a CrewAI manager agent spawns a worker, should the worker get the same credentials? Most teams answer this wrong. Here's the right model...

January 20, 2025

The Definitive Guide to GitHub OAuth Scopes for AI Agent Developers

GitHub's OAuth scope documentation is written for human app developers. AI agents have different access patterns. This is what you actually need to know...

January 13, 2025

Choosing the Right Token TTL for Your AI Agents

15 minutes vs. 4 hours vs. 24 hours. The right TTL depends on your agent's task duration, failure recovery model, and tolerance for extra latency on token refresh...