Blog
Notes from building Timonier. Mostly architecture decisions we had to actually commit to, written up with the reasoning intact.
-
Moving off Auth0 or Clerk to an EU-resident identity provider
What changes at the architecture level, what stays the same because it is just OIDC, what you cannot migrate, and the one thing we have decided against for good.
-
Passwordless sign-in without a password table
The complete column list of our users table has no password, no hash, no salt. Here is what replaces it: hashed one-time credentials, two independent single-use guards, and why the second-factor gate keys off the user rather than the endpoint.
-
Why we don't do "Sign in with Google"
Federating end-user sign-in to Google, GitHub or Apple puts a US-headquartered company on the authentication path. We ruled it out, and kept being an OIDC provider ourselves.
-
White or black? Deriving readable label text from any brand colour
Operators pick their own button colour, and one of them could ship a sign-in button whose label sits at 1.4:1. Choosing whichever of pure white or pure black has more contrast is provably always at least 4.58:1.