Aaron Parecki

Meetable can now replace your Doodle polls! Meetable, my open source event listing website, now lets you propose an event with several possible dates/times. People vote on which one works for them, and the organizer can choose the best date from the votes later.

OAuth originally assumed clients would be pre-registered at an authorization server.

Cross-domain access is everywhere in today's software landscape. Whether you look at enterprise SaaS applications, AI agents interacting with user data across multiple platforms, or "integrated experiences" pulling information from a calendar, a chat tool, and a wiki—everything eventually needs to talk across boundaries.

The new MCP authorization spec is here! Today marks the one-year anniversary of the Model Context Protocol, and with it, the launch of the new 2025-11-25 specification.

In October, I launched an instance of Meetable for the MCP Community. They've been using it to post working group meetings as well as in-person community events. In just 2 months it already has 41 events listed!

Today I just launched support for BlueSky as a new authentication option in IndieLogin.com!

The IETF OAuth Working Group has adopted the Client ID Metadata Document specification!

I just released some updates for Meetable, my open source event listing website.

Every time I take a Lyft from the San Francisco airport to downtown going up 101, I notice the billboards. The billboards on 101 are always such a good snapshot in time of the current peak of the Silicon Valley hype cycle. I've decided to capture photos of the billboards every time I am there, to see how this changes over time. 

I've seen a lot of complaints about how MCP isn't ready for the enterprise.

Update: The changes described in this blog post have been incorporated into the 2025-06-18 version of the MCP spec!

Here's where you can find me at IETF 121 in Dublin!

I just did a massive spring cleaning of one of my servers, trying to clean up what has become quite the mess of clutter. For every website on the server, I either:

The first law of OAuth states that

The sessions I will be attending and presenting at during IETF 120 in Vancouver

IndieWebCamp Düsseldorf took place this weekend, and I was inspired to work on a quick hack for demo day to show off a new feature I've been working on for IndieAuth.

The draft specification OAuth for Browser-Based Applications has just entered Working Group Last Call!

Is it called an OAuth "grant" or a "flow"? What about "grant type"?

It was 11am at the Fort Lauderdale airport, an hour after my non-stop flight to Portland was supposed to have boarded. As I had been watching our estimated departure get pushed back in 15 minute increments, I finally received the dreaded news over the loudspeaker - the flight was cancelled entirely. As hordes of people started lining up to rebook their flights with the gate agent, I found a quiet spot in the corner and opened up my laptop to look at my options.