A developer argues for flipping the traditional authentication model: instead of users proving identity to an application that owns their data, applications should request authorization to access a user-controlled database. The author built this into 'ayb', an open-source project that makes spinning up personal SQLite/DuckDB databases easy. Using OAuth2 with PKCE, static web apps can request a token to read/write a user's own database with no login screen. The post covers three principles: authorize instead of authenticate, make database creation as easy as creating a document, and minimize server-side state. Limitations around collaborative and social data are acknowledged, and connections to local-first, ActivityPub, and AT Protocol are explored.
Table of contents
Holding on to your dataTrusting your hostBeyond personal data: collaboration and social interactionsWhere we go from here180 Impressions1 Comment