Travis Spencer
- Founded Curity, an API-focused identity server used in regulated and open-banking deployments
- Co-founded Nordic APIs, a long-running API practitioner community
Bio
Travis Spencer founded Curity, a Stockholm-based identity server built around API access security, and co-founded Nordic APIs, a practitioner community and conference series for API developers.
Profile built from public company and community records.
Where their work shows up
Curity sits at the end of the market where OAuth has to survive a regulator: token exchange, mutual TLS and sender-constrained tokens, and FAPI profiles for open banking. That work pushed financial-grade patterns into general practice, and the community half of it, Nordic APIs, spread them to developers who would never read a specification. See the Curity profile and the FAPI deep-dive.
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b