OAuth solved delegation for a federated web. It does not solve identity for systems where every device, every session and every request needs to be trustworthy. Here's the gap — and what closing it looks like.
OAuth is the most successful security protocol of the last two decades. It works because it solves a narrow, real problem — letting one service grant another limited access to a user's data without sharing credentials. Everywhere a 'Sign in with…' button exists, OAuth is doing its job.
But OAuth doesn't solve identity. It solves delegation. The token it produces says one thing: 'this user agreed to grant access.' Once that token leaves the place it was issued, nobody can tell whether the party presenting it is the party it was given to. The token is the identity. Whoever has it, is the user.
In the federated web of 2010, that was acceptable. Browsers were the only client, tokens lived briefly and the attack surface was narrow. In 2026, the picture is different:
Every additional hop is another chance for the token to escape, and every escape is total: the holder becomes indistinguishable from the user. That is the problem OAuth was never designed to solve.
The industry's reflex is to make tokens shorter-lived, rotate them more often, and watch for unusual behaviour. Each helps. None changes the underlying fact that a valid token, in the wrong hands, still works. You are managing exposure, not removing it — and the more clients, services and agents you add, the more exposure there is to manage.
Real identity isn't established once at login and assumed forever after. It is continuous. Every request should be able to answer three questions with confidence:
Enravo Core answers all three on every request. Sign-in still works the way your users expect, and your existing identity providers keep working. What changes is what a session is worth outside the device and app it belongs to: nothing.
Concretely: leaked tokens stop being incidents. Lost devices stop being breaches. A browser extension that exfiltrates auth headers, or a monitoring tool that captures more than it should, loses its leverage — because a token alone is no longer enough to act.
None of this replaces OAuth. We extended it. Delegated consent, federated sign-in and the familiar login experience all remain. What's different is what a session proves at every request after login.
OAuth, by itself, says 'this user agreed to delegate access.' That's a contract, not an identity. Identity is the continuous assurance that the same entity is still the one asking. OAuth was never built for that — which is why serious identity systems in 2026 are built on top of it, not from it.
Zero trust isn't a product. It's an admission that no single signal — no token, no certificate, no IP address — is enough to verify intent. Every request has to carry its own proof. OAuth gave us the standard for delegating consent; Enravo Core gives you the confidence to trust what happens after it. If your security model still ends at 'the token was valid', talk to us.
Recent articles on platform, security, and engineering.
A platform is a claim until something real runs on it. Rakton is the first product family built on Enravo Core — and building it changed Core more than we expected.
Read moreAssembling a stack from best-in-class services is the sensible default. Here is the specific reason we did the unreasonable thing instead — and what it cost.
Read moreA tablet on a shop counter is shared, public, and occasionally offline. Designing for it forced us to rethink what device trust means when the device is not personal.
Read more