Clever

SAML Protocol

The SAML protocol is an open standard for exchanging authentication and authorization data. Learn how it works with Clever engineers.

OpenID Connect

OpenID Connect allows users to log in to different applications using a single set of credentials. Learn about the protocol at Clever.

What is OAuth?

What is OAuth? This widely used protocol provides a mechanism for secure access delegation across the internet and a whole lot more...

AuthN vs AuthZ: What is Auth?

When you hear the term Auth, what comes to mind? Auth masks two independent but closely related fields: Authorization and authentication

Privacy and Security in Clever Messaging

We discuss security, privacy, and technical challenges we faced while creating Clever Messaging, used by millions of students and teachers.

Interviewing at Clever: Answers to the 10 most common questions

What’s it like to be an engineer at Clever? Four engineers share their perspectives and answer common questions from interviewing at Clever.

Working at Clever: a perspective from a former intern turned full time engineer

During my final search for an internship, I had an idea of where I wanted to work: a place with a friendly culture and strong engineering practices – something in between a startup and a big company. To my luck, I interned at Clever – an organization that surpassed those expectations in the span of […]

How we handle multi-region sessions at Clever

Why multi-region sessions? Each year leading up to Back to School (our busiest season), Clever’s engineering team invests in our highest traffic systems to make sure we can handle user growth and new traffic patterns. During 2020–2021, SAML auth at Clever grew from <10% of our login related traffic to about 40% of our traffic! For this […]

Lessons learned: My first year transitioning from an engineer to a manager

Emily Hou talks about her transition from an individual contributor to an engineering manager at Clever.

How Clever Secures Infrastructure Secrets Using AWS SSM Parameter Store

Context At Clever, we rely on nearly two thousand infrastructure secrets like DB access keys, API tokens, and session secret keys to provide our services to students and teachers.  Properly securing these secrets so we don’t expose them in our various environments requires thorough engineering efforts. In fact, securing secrets is generally a hard problem …

Choosing Golang for Clever

Listen to an interview with our CTO and architect discuss how we chose Golang as our new computer language.

Evolving Systems for New Products

When building systems for new products, there’s a delicate balance between writing code that works and writing code that lasts. A common anti-pattern is preemptively optimizing systems for the future while still trying to find product market fit. For new product teams, this can be a costly mistake as it leads to a slower iterative …

How Clever grows inclusivity for women in engineering

Five women on Clever’s engineering team discuss what inclusivity looks like at Clever, how to grow and maintain female leadership at a tech company, and the challenges they are excited to tackle within their roles.

Using IAM Roles with Session Policies for Least Privilege

How Clever locks down code access to customer data with AWS IAM role session policies.

Clever SSO Resiliency — October Update

Everyone in the US is now back in school, and we’ve been feeling the rush of excitement here at Clever over the last few weeks. On a typical day at Clever this school year, we regularly hit more than 1,000 logins per second! As we’ve chronicled over the last few months (July, May) , the …

Clever SSO Reliability — July 2018 Update

Over the last few months, we’ve been readying Clever SSO for our biggest year ever. We want students across the country logging in quickly and reliably to all of their learning applications. A couple of months ago, we described our initial stress testing approach. In this post, we want to tell you more about this …

Securing New Products at Clever

A collaborative security team can prevent risks even when they’re not in the room. This makes security a more flexible and lightweight addition to the product iteration cycle.

Clever Reliability — May 2018 Update

Two months ago, we experienced the worst outage in the history of Clever SSO. We wrote up a postmortem soon afterwards. We mentioned at the time that this postmortem was the beginning of our process to reevaluate everything we do to make sure we can be worthy of the trust you place in us. We …

Save sanity and time: Why Clever adds yet another timestamp to our analytics data

For data engineers and analysts, it’s pretty common to get questions about missing or incorrect data. “Hey Data Engineer, there’s an issue with the data – I expect numbers at least 20% higher than what our reporting tools show. Can you take a look?” If you’ve ever been responsible for a Business Intelligence pipeline, you’ve …

Wag: A Go Web API Generator

This story begins someplace familiar to many startups: our monolithic API had become unwieldy, and we wanted to transition towards a microservice architecture. And, like other young, scrappy startups, we couldn’t afford to freeze development while we re-architected the entire system. So, instead, each time we wrote a feature we carved off the related chunk …

Postmortem on Last Week’s Outages

On Tuesday, Wednesday, and Thursday, March 6th-8th, 2018, Clever logins failed for all customers: 1h on Tuesday, 1h15 on Wednesday, and almost 5h on Thursday. This was Clever’s single worst outage ever in length, repeatedness, and impact. This postmortem is the first of many public steps we’ll be taking to ensure Clever is a service …

saml2-js and CVE-2017-11429

Clever maintains an open source library implementing the SAML protocol in Node.js known as saml2-js. Over the past month, Clever worked with CERT to address a vulnerability in our open-source SAML2 library.

Swappiness and Amazon ECS

We made changes to fix memory allocation issues in AWS Elastic Container Service (ECS) related to container swappiness.

Mo Repos, Mo Problems? How We Make Changes Across Many Git Repositories

At Clever, we use microservices, and we create a Git repo for each service. It's hard to make changes across many repos, but microplane makes it easy.

Defining Clever’s Engineering Culture

Clever's engineering culture tenets: Code with Empathy, Code with a Sense of Urgency, Learn and Teach Every Day, Be Excellent Guardians of our Users’ Data.