← All concepts
Security
Authentication & tokens
Verify who a user is once, then give them a token every service can check cheaply.
Users sign in with a password, social login or OTP. The identity service issues a short-lived signed token (often a JWT) plus a refresh token. The gateway verifies the signature on every request without a database lookup.
See it in action
Step through the scenarios on the diagram.
Laying out diagram…
1/5The user clicks 'Log in'.
- Browser
- — The user signing in
- Your app
- — Starts login, exchanges the code
- Identity provider
- — Checks credentials, issues tokens
- API gateway
- — Verifies token signatures
- API
- — Trusts claims in the token
How it works
- OAuth 2.0 / OpenID Connect for login flows and third-party access.
- Short access-token lifetimes plus refresh tokens limit damage from leaks.
- Services authorise using claims in the token (user id, roles, plan).
Trade-offs
- Revoking a stateless token before expiry needs a deny-list.
- Never store passwords yourself without a proven hashing scheme — prefer a managed identity provider.