Authentication

You might say

How do I verify that someone is who they say they are? I need to add sign-in.

Verify who is making the requestAuthentication proves an identity through a password, passkey, one-time code, or trusted provider and then maintains a session. Store credentials safely, limit repeated attempts, and protect recovery paths. After identity is known, authorization still decides what that person may do.

Know first

Route & Endpoint Database Env Var

Emailyou@example.com Password••••••••

Quick checkChoose the best answer

A request with a valid session opens My Orders. What must the system establish first?

Which signed-in user this request belongs toThat the page displays a user avatarWhether the user is an admin or a member

You can say this to an AI Agent

The orders page currently trusts a userId sent by the browser. Change it to obtain the current user from verified sign-in state before querying orders. Test signed-in and signed-out access: the first must show only that user’s orders, and the second must require sign-in.

When to use it

Sign a user in
Maintain a secure session
Verify a sensitive action again
Recover account access through a controlled process

When NOT to use it

Store plain-text passwords
Treat a user ID sent by the browser as proof of identity
Use long-lived tokens with no revocation plan
Reveal whether a private account exists through detailed errors

Anatomy

Identity credentials→Server verification→Login status

Password, one-time verification code or identity result returned by third-party platform

The server checks the credentials, speed limit and handles the failure. It does not believe that the front end announces that the login is successful.

Use secure cookies or protected tokens to allow subsequent requests to prove it is the same user

Variants

Cookie Session

Set-Cookie: session=…

Common for web apps; browsers send the cookie automatically.

Bearer Token

Authorization: Bearer …

Common for mobile apps and standalone APIs.

OAuth Login

Continue with GitHub

Delegate identity proof to a trusted provider.

Typical use cases

Email passwordEstablish login status after successful verification

Emailoil@example.comPassword••••••••Login

Session✓ Established

Passkey

One-time verification codeThe verification code is only valid for a short period of time

6-digit verification code482 913

Remaining time04:32Number of attempts1 / 5

Verification

One-time code

Third-party loginLeave identity verification to a mature platform

Continue using GitHubContinue using Google

The platform returns the identity result, and this site then creates its own session

Account recovery

Exit and expirationRe-authentication is required after the session expires

Click to exit→Server-side revoke Session→Protected request → 401