tedvir.jp

Authentication and digital identity — from the specification to the implementation.

OpenID Connect / OAuth 2.1 / OpenID Federation / OID4VC.

I read the specifications at source and turn them into designs and working code. Based in Yokohama, working directly with your engineering team.

At Akinon, a Turkish e-commerce platform company, since 2019: I have led thirty or more enterprise projects and am now tech lead on the core product team, where I also run the Akinon Cloud Commerce developer certification. Alongside that, I am an individual contributor to the OpenID Foundation, and I build QAuth, an open-source OAuth 2.1 / OIDC authorization server.

Japan-side engineering, in JST — European mornings and Japanese business hours in the same working day.

GitHubLinkedIn
Yokohama, Kanagawa, Japan (JST)Work is conducted in English (Turkish native; Japanese in progress)

Currently at capacity — start dates by arrangement

Last updated: 24 August 2026

I also take the design work for delegating authority to an AI agent — how far the delegation reaches, where a human approves, what the audit trail records, and how it is revoked immediately.

{
  "iss": "https://issuer.example.jp",
  "vct": "https://credentials.example.jp/student_id",
  "_sd_alg": "sha-256",
  "_sd": [
    "S1hIeGhTQ2FrOGRJYm5HeUpQVFVMdw",
    "b1RTNmxpZ0R2WWNTN3g4dnVBUXRxdw"
  ],
  "cnf": { "jwk": { "kty": "EC", "crv": "P-256" } }
}
Illustrative: the shape of an SD-JWT VC payload — the holder chooses which attributes to disclose at each presentation. Structure per the specification; values are dummies.

The conversations that usually start this way

  • "We need to support OID4VC for digitised credentials — My Number Card, enrolment certificates, employment certificates."

    The specifications are public, but nobody in-house can read SD-JWT VC, mdoc and the issuer–verifier trust model at source and say which one you actually need.

    I work alongside you from choosing the approach through to a working proof of concept — pinning which specification and which version you are building against first, and writing down why.

  • "We deployed Keycloak and got stuck on multi-tenancy, federation and token design."

    Realm layout, the authorization model, custom SPIs, the migration plan — and no clear judgement about what to fix first, so implementation has stalled.

    I review the design and then work directly with the engineers doing the work. It does not end at a written report.

  • "We want an AI agent to operate our internal systems, and we do not know how to design permission, consent and audit for it."

    How far the agent may go, and who can stop it when. Your existing permission model has no way to express that sentence.

    Delegation built on OAuth, human approval in the loop, revocation, and isolation of the execution environment.

Services

I take on authentication and digital identity work, and the agent side of it — the authorization design, and the architecture of the workflow itself. Nothing else.

  • Advisory retainer

    On your chat, a design review every other week, and review of your design documents.

  • Design and implementation (project work)

    OID4VC proofs of concept, Keycloak deployment and migration, OAuth 2.1 migrations, passkey rollout, and more.

  • Authorization design for AI agents

    Delegation, consent, audit trail and immediate revocation. One-off reviews too.

  • AI-driven workflow architecture

    The unit of work an agent is handed, where a human stops it, acceptance criteria a machine can check, and the rollback when it fails.

Work

Open-source work and contract work in one list, not separated. Most readers want to know the level of responsibility before the technology, so every item carries the role I held.

  • vitrin OS

    AuthorPersonal project

    How much of the screen and the keyboard can you hand an agent?

    An agent-first display server in Rust and Smithay. Authority is a grant — (principal × resource × verbs × constraints) — the consent prompt is drawn by the trusted core itself, and holding Escape revokes every live grant. A capability-native wire protocol of fourteen interfaces generated from an IDL with drift checked in CI, eleven crates of Rust, a per-application shim in C, and a Python SDK: all of it written solo since July 2026. Realms spawn under user, mount, PID, IPC, UTS and net namespaces with Landlock and seccomp, and the core measures the isolation tier it actually reached, refusing to start below a stated floor.

    Author and sole maintainer　July 2026 – present

    vitrin-os.github.ioGitHub

  • QAuth

    AuthorOpen source

    An authorization server for the agent era

    An OAuth 2.1 / OIDC 1.0 authorization server aimed at MCP servers and AI agents: discovery, dynamic client registration, resource-indicator audience binding, consent, and on-behalf-of delegation with scope modes and step-up all work by default. Wallet federation puts OID4VP upstreams and external OIDC providers behind a single CredentialProvider interface and completes a browser sign-in end-to-end against a mock wallet — but it is off by default, validated only against the oid4vp-1.0-base profile, with HAIP and a real-wallet pass still open. Hybrid ML-DSA-65 + Ed25519 signing is implemented and likewise default-off. A TypeScript Nx monorepo, with eleven ADRs recording the calls, published under Apache-2.0.

    Author and maintainer　October 2025 – present

    qauth.devGitHub

  • Sidre

    AuthorTech lead

    Making a classical Arabic corpus something you can actually search

    An Islamic-studies digital library for the Arabic-speaking world: 8,115 or more critically edited volumes and 3,188 or more authors, free and without advertising. Search that steps over Arabic morphology is useless, so full-text search is Elasticsearch combined with Arabic NLP — MADAMIRA and CAMeLBERT. Seven applications in an Nx monorepo — a NestJS API, web, dashboard and partner surfaces on TanStack Start, a Flutter mobile app and a Keycloakify authentication theme — in production since September 2025.

    Author and tech lead　September 2025 – present

    sidre.app

  • Akinon

    Tech leadContract work

    Running an enterprise e-commerce frontend without adding people

    A Turkish e-commerce platform company (B2B SaaS, many enterprise deployments). I have led thirty or more enterprise projects, and am now tech lead on the core product team. The work itself: the UI extension platform customers build their extensions on, the re-platforming to micro-frontends that separated the unit of release, and the agent platform for code generation and test automation. I also run the Akinon Cloud Commerce developer certification.

    Tech lead, core product team　2019 – present

    akinon.com

Other work

No case-study page for these, but listing them keeps the range visible.

  • Majordomo

    AuthorPersonal project

    A multi-agent platform with long-term memory backed by Qdrant. The memory service is protected with OAuth 2.1.

  • Medaris (Amel Tech)

    Product manager

    An open-source platform that brings the classical medrese method of teaching online. I act as product manager. Development happens in the open, in the Amel Tech GitHub organisation.

    amel-tech.orgGitHub

  • Keycloak / Keycloakify

    Implementation

    Theme and extension work — customised login surfaces and extensions written against specific requirements.

Verifiable facts

Where an item has a public source, it is linked.

Start with 30 minutes. Just the requirement.

Sometimes the shape of the answer is clear in the call. Sometimes it is not, and I will say so rather than guess. Either way you will know which by the end of the 30 minutes.

GitHubLinkedIn

All available hours are currently committed. New engagements are taken on with a start date agreed in advance.

Tell me the requirement first. I will come back with a realistic start date and how I would approach it. A conversation on its own is fine.

Last updated: 24 August 2026

I reply within one business day.