API Evangelist Weekly — Enterprise-Managed Auth Went GA, and OpenAPI Came Back to the Headlines as a Malware Vector

Last week I wrote that everything getting better was getting better by making a authorization grants smaller. Task-based consent, optional scopes, narrower tokens. I said the agent era keeps discovering the answer was already in the API junk drawer. This week the drawer got emptied into a product roadmap. Enterprise-managed authorization went generally available, and within days a second wave of writing showed up asking the question that follows immediately after: fine, the grant is narrow — but a grant is one hop, and an agent calling an agent calling a tool is three. Where does the consent go when it crosses boundaries? Nobody seems to have a good answer yet. What is notable is that people are now asking this question publicly, with implementation details attached, rather than just with a diagram or infographic (generated by AI). Two other things happened that I want to put next to each other, because I do not think either means much alone. The first is that after a week in which literally zero third-party posts in this network named a specification in a title, OpenAPI came back — in three security advisories about a self-replicating worm inside openapi-react-query-codegen. The description layer nobody is writing about turns out to be load-bearing enough that compromising one of its code generators propagates across three package ecosystems. The second is quieter. One in five MCP posts this week was published by a help desk. Not a launch blog, not an engineering post. A support article, with a ticket-deflection URL. That is what a technology looks like on the way to becoming plumbing. A vast dark neon grid at dusk where a single enormous ceremonial archway has been dismantled into hundreds of small identical service doors set into a low continuous wall, each one lit a different faint colour, with streams of small angular light-vessels queuing at individual doors while one long chain of vessels passes through four doors in sequence and grows visibly dimmer at each one. Enterprise-Managed Auth Went GA, and the Consent Chain Got Lost Last week this was a design principle. This week it is a generally available product with a migration path, and the interesting writing has already moved one hop downstream. WorkOS shipped enterprise-managed auth to GA and told MCP server builders they need a new grant type. That second clause is the whole story. A GA announcement that also tells you your existing integration is on the wrong grant is not marketing, it is a migration notice. Supabase shipped enterprise-managed auth for its own MCP server in the same window, and Auth0 added a UI to an Auth0-secured MCP server with Skybridge. Three companies, one week, the same shape: the enterprise admin grants, not the user clicking through a dialog. Then Cerbos published the post that actually advances the argument — multi-hop delegation for AI agents, and how the consent chain gets lost. Every consent mechanism shipped this year assumes one hop. The user consents, the agent acts. But agents call agents, and by the third hop the thing holding the token has no structural memory of what the human agreed to. Cerbos is the first vendor I have seen state that plainly rather than pretending narrow scopes solve it. Cerbos had the run of the week generally, and all of it circles the same seam: Istio authorization stops at identity, not at what a workload may do, and not every authorization decision is allow or deny. Both are arguments that authentication and authorization are different problems, which is the thing I complained the industry keeps conflating two weeks ago. Nudge Security wrote up what OAuth scopes really control, and their URL slug is more honest than their title: the fine print nobody can read. We are asking users to make informed delegation decisions through a consent screen listing strings they have no way to evaluate. The infrastructure kept narrowing underneath. Cloudflare added app-scoped API tokens for Flagship. WorkOS argued that running your own OAuth and OIDC provider in 2026 is an operations problem, not a build problem — which is what identity vendors always argue, but the operational surface genuinely did just grow a new dimension. And the Linux Foundation's Decentralized Trust group opened PDP-Connect, a specification lab for personal data consent and authorization. A standards body forming around consent, at the exact moment the vendors have shipped five incompatible versions of it. That sequence is not new and it is not going to be fast. The pattern I would flag: everything in this section is a product. Nobody standardized anything. PDP-Connect is a lab, not a specification. We narrowed the grant and shipped it five different ways, and the multi-hop problem Cerbos names is exactly the kind of thing that does not get solved five different ways — it either gets a shared vocabulary or it stays broken. An immense dark neon grid where a towering ornate broadcast spire stands unlit and abandoned, while at ground level a long low utilitarian counter stretches to the horizon lined with dozens of identical small lit service windows, a patient orderly queue of small angular light-vessels at every one. MCP Moved From the Engineering Blog to the Support Desk I count 66 third-party posts that named MCP in a title this week. Fourteen of them — one in five — were published on a help desk, a support centre, or a docs changelog rather than a blog. Katana has three. Qargo has three. Mixmax, Frontify, Instabug, SAP's community forum, Buildkite's changelog, Cloudflare's changelog. That is a genuinely different week than the ones before it. A launch post is written by devrel for an audience that might adopt you. A support article is written by a support team for customers who already did, and who are now filing tickets. "Unable to connect AI through Katana MCP?" is not an announcement. That is a ticket-deflection page, and you only write one after the tickets arrive. The long tail shipped, in volume: Gravity Forms, Knack, with a HIPAA-compliant angle, Runpod, Testmo, Sinch, Losant adding write tools, Aha's MCP connectors, Vantage adding Linear, Notion and GitHub, G-P for global workforce data, and Everlaw wiring into Google Gemini Enterprise. Thirty days after the spec revision, Arcade published what actually changed — the most useful retrospective of the week, because it is written from the position of someone who had to migrate. Cloudflare's MCP server portals now support the 2026-07-28 specification, and Open Liberty shipped MCP Java API support so you can expose Liberty business logic as agent tools. The enterprise Java stack arriving is always the last signal before something is boring. The gateway category kept consolidating and the tooling started getting graded. Zuplo compared ten MCP server generators — a comparison post only exists once there are enough implementations to be confused between. OpenVPN introduced an MCP Gateway as one front door for every agent a business runs, and cData spent the week arguing what an MCP gateway does that an API gateway cannot. On the security side, Escape published a guide to pentesting LLMs and MCP servers, and ScrapingBee made the sharpest architectural point of the week almost in passing: MCP servers should carry control, not data. Piping a scrape result through the context window is the expensive way to do everything. And the new MCP roadmap circulated widely, which is where the protocol says out loud what it intends to become. I have been doing this long enough to recognize the shape. This is the same arc SOAP had, then REST, then webhooks: announcement, comparison post, generator, gateway, support article. MCP got there in about eighteen months, which is fast, and the support-desk tell means the adoption is real rather than performative. It also means the interesting work has moved. When your protocol is a help-centre topic, the differentiation is no longer whether you have one. 📄 MCP Documentation Beyond Reference — Fourteen support articles about MCP this week is the tell that reference documentation is not enough. An agent does not fail on your parameter types. It fails on the third call, in a state your docs never described. This is the five-part operational layer most MCP servers ship without: the order operations must run in, the side effects, the rate limits, and what happens when a call half-succeeds. Written for the provider who would rather document the behavior than answer the ticket. $25 A dark neon grid dominated by one colossal blueprint-lattice structure of clean glowing lines, beautiful and precise, with a thin vein of sickly green light entering at one low corner and branching upward through the lattice, and three smaller identical lattices in the far distance showing the same green vein at the same corner. OpenAPI Came Back to the Headlines, as a Malware Vector Last week I reported a number I did not enjoy reporting: zero third-party posts in this network named OpenAPI, AsyncAPI, GraphQL, JSON Schema, Arazzo or gRPC in a title. Not a small number. Zero. This week there are eight. I would like to tell you the description layer had a renaissance. Three of the eight are security advisories about the same worm. Socket reported that OpenAPI React Query Codegen was compromised in the Mini Shai-Hulud npm supply chain attack. Mend counted ten malicious versions. Endor Labs tracked it spreading across npm, RubyGems and PyPI — a self-replicating worm that jumped package ecosystems from a trojanized OpenAPI code generator. The remaining five are ordinary maintenance and integration work: Redocly shipped point releases of its OpenAPI, AsyncAPI and GraphQL docs packages, Truto wrote an end-to-end architecture guide for auto-generating MCP tools from OpenAPI specs, and Yaak added GraphQL schema files to its changelog. Here is why I think this matters more than the raw count. A code generator is the most trusted thing in an API toolchain. You point it at a contract, it writes the client, and the client goes into production. Nobody reads that output line by line. The contract is the thing everyone treats as authoritative, and the generator is the unexamined machine that turns authority into running code — which makes it a nearly ideal place to hide. We spent the last month watching the industry build gateways, registries, portals and consent screens on top of a description layer that almost nobody writes about any more. This week we learned what happens when someone attacks that layer's tooling instead of its specification. It propagated to three ecosystems before it made a headline. And here is the week in numbers, pulled from the 6,768 unique posts across 1,927 provider blogs between the 23rd and the 30th: 66 third-party posts named MCP in the title. 14 of those were on a support or docs surface. 360 posts — 5.3% — carried any API-related keyword in the title at all. The other ninety-five percent is what a network of company blogs actually publishes: pricing pages, release notes, hiring posts, industry commentary. That ratio has been remarkably stable at five to six percent for a month now. 8 third-party posts named a specification, up from zero. Three of the eight are the worm. One more housekeeping note in the spirit of last week's complaint. I fetched every third-party story in this issue with an ordinary browser user-agent to confirm the links resolve. Three refused me with a 403: Fireblocks' comparison of the agentic payment protocols, Sinch's guide to using its own MCP server, and cData's piece on what an MCP gateway does that an API gateway cannot. Read that list slowly. A custody provider explaining how autonomous agents should pay for things. A communications platform documenting the MCP server it wants agents to call. A data company explaining the gateway it wants to sell you for governing agent traffic. All three behind bot protection that refuses a machine reading the web. cData was on this list last week too, for a different post. That is the part worth sitting with — it is not a one-off misconfiguration, it is a standing default nobody has revisited, and it is running on the blogs of the companies whose entire pitch is machine consumption. I keep finding this and I am going to keep counting it. Four smooth glowing toll-arches on a dark neon grid, two of them wide with heavy braided streams of small angular light-vessels flowing through, one moderately busy, one nearly empty, and behind them a tall bare tally-column of stacked light-blocks rising much higher than the week before. Agent Payments Went to Four Protocols, and Grew Real Volume Last week Formance put three agentic payment protocols side by side and I said three credible contenders is the normal shape of a standards fight. It took one week to become four, and this time somebody put transaction volume next to it. Fireblocks compared x402, AP2, MPP and ACP — the second four-way comparison from a company that moves real money, one week after the first three-way. When custody providers start writing comparison matrices, the procurement conversations have already started. The volume is no longer hypothetical. Solana claims the top spot on x402, with AI agents settling $3.3M USDC in a single week, and it flipped Base in daily x402 transactions for the first time in six months. Treat single-chain marketing numbers with the skepticism they deserve, but a competitive fight over agent settlement share is a different world from a year ago, when 402 was one protocol and a lot of blog posts. I have been building the x402 machine door on my own storefront, so I have a stake in this and you should weigh what I say accordingly. My read: four protocols is one too many for anyone to build against confidently, and the deciding factor will not be protocol design. It will be which one a payment processor makes boring first. A long dark neon corridor lined with a dozen tall doorways, each with a small glowing hand-crank beside it and no automatic mechanism, a single small angular light-vessel stalled at the third doorway, while far above the corridor a bright precise measuring-frame hovers scoring each doorway with rows of small blank light-marks. From My Desk: Every Door Still Needs a Human Hand The onboarding series hit the wall from three more directions this week, and then WorkOS published the same finding from theirs. Notion hands you the token, but only after you click. HubSpot has the OAuth, but not the onboarding. Discord will not let you register an app programmatically at all. Atlassian makes you click through a console before an agent can touch Jira. Then WorkOS wrote up what shipping an OAuth app on Slack, Microsoft and Atlassian actually takes — arriving independently at the conclusion I have been documenting provider by provider. The agent can hold the credential. It still cannot obtain one. I shipped the other half of the rating work. Inside the Agent-Readiness Score opens up the standalone layer that sits beside the composite, and your agentic programmability investment is an API foundation investment is the argument underneath it. The Australian banking thread turned into the most interesting finding I have had in a while: low composite, high agent-readiness — the Australian banking paradox, and why the agentic turn rewards what Australia's banks already ship. Regulation forced them to publish standards and artifacts years ago, for reasons that had nothing to do with agents, and it turns out to have been the exact preparation. On MCP, which is where most of my writing went: the MCP roadmap is an API roadmap, the federation aspect MCP needs, next MCP API design, what Medusa teaches every MCP author about feedback, and the one I would point at first — every MCP server bakes in the provider's motivations. Which tools you expose is a business decision wearing an engineering costume. Elsewhere: ClaudeBot read my entire catalog in a single day, which is the agent-traffic story arriving on my own doorstep. Your agent should run its own observability stack. Bringing coherence to sprawling enterprise API estates. Bringing order to the agentic realm with the CLI Agent spec. OpenAPI Overlays for test fixtures and mock generation. And two on business models — what is commercial open source, really and the self-hosted seed is the next business model. A conversation with Emma Kriskinans on marketing from inside VS Code, building a trust hierarchy for your sources, and filling in the middle ground on AI. Emma is VP Global Marketing at Tyk, and since March she has done most of her working day inside Claude Code — not because anyone asked, but because she wanted to learn it at the harder level. Her analogy is the UK driving test: learn on a manual and you can drive an automatic, but not the other way round. We compare notes on the trust hierarchy document she keeps to tell the model which sources to weight, what she deliberately refuses to use it for, and the AI-disclosure etiquette forming in both directions. It ends somewhere neither of us planned, on novels and whether the humanities graduate's moment has finally arrived. I also wrote it up as filling in the middle ground on AI. A conversation with Danny Preussler on reopening the SoundCloud API, the agent that scraped its way to a token, and writing documentation for machines. Danny is an engineer on the API team at SoundCloud. This is one of the great API origin stories and one of the great API closures — a public API in 2008, the Android lead hired because he built a better SoundCloud app on it than SoundCloud had, then the labels, the scrapers, a hundred thousand apps registered in 2016, and the 2017 shutdown that was supposed to be temporary. He walks through the soft reopening, and the moment that changed everything: they handed an agent the task of creating a SoundCloud app, it could not find a token, so it scraped the website for one and quietly rewired itself from the public API to the internal one. Read that next to my onboarding series and to the WorkOS post above. This is what happens at the end of a front door that requires a human hand. The through-line this week is smaller than usual and I think it is the right size. We are getting extremely good at the second hop and still cannot do the first one. Enterprise-managed auth is GA. Consent chains, four payment protocols, ten MCP generators, a gateway category with a comparison matrix. And an agent still cannot register an application on Notion, HubSpot, Discord, Atlassian or Slack without a person clicking a button — so when SoundCloud gave one a real task, it went and scraped a credential off the website instead. Everything upstream of that button is beautifully governed. The button is not governed at all. See you next week. 🔌 APIs.io Pro — OAuth scopes and security artifact collections — This whole issue argues that the grant should be narrower. Here is the part I can hand you: I have the OAuth scopes and security definitions extracted from every API in the catalog, as artifact collections you can query. Eighteen of the twenty per-artifact endpoints on APIs.io are free. These two are not, and they are the two people push on hardest — security and scopes are the most-hit Pro walls by an order of magnitude, well ahead of the ratings everyone assumes is the product. The operation worth your week: before you design your next set of scopes, go read how a few hundred other providers named and split theirs. curl -H "X-API-Key: $KEY" "https://apis.io/api/v1/scopes?limit=50" Same data as the find_scopes MCP tool, if you would rather ask an agent. Pair it with /v1/security to see which auth schemes those same providers actually declare, and you have a real baseline to design against instead of copying whatever your gateway scaffolded. Pro is $49/mo — log in with GitHub for a free Starter key first and see how far the free tier gets you. Unsubscribe | 606 W 57th New York, NY 10019