wehub-resource-sync
99 lines
4.3 KiB
Plaintext
99 lines
4.3 KiB
Plaintext
---
|
|
title: "Authentication"
|
|
sidebarTitle: "Overview"
|
|
description: "Use InsForge to authenticate and authorize your users."
|
|
---
|
|
|
|
Use InsForge Authentication to handle sign-up, login, sessions, and identity for your app. Users can sign in with email and password, magic link, one-time code, OAuth providers (Google, GitHub, Apple, and others), or any OIDC-compliant identity provider you bring. InsForge issues JSON Web Tokens on login, and every other product on the platform consumes the same token.
|
|
|
|
<Frame caption="Configured sign-in methods: email and password, Google, and GitHub OAuth.">
|
|
<img src="/images/authentication-methods.png" alt="InsForge dashboard Auth Methods showing email and password, Google OAuth, and GitHub OAuth" />
|
|
</Frame>
|
|
|
|
<Note>
|
|
**Authentication** is checking that a user is who they say they are. **Authorization** is checking what they can do. InsForge handles the first directly and powers the second through [row-level security](/core-concepts/database/overview) policies that read the auth JWT.
|
|
</Note>
|
|
|
|
```mermaid
|
|
graph TB
|
|
Client[Client Application] --> SDK[InsForge SDK]
|
|
SDK --> AuthAPI[Auth API]
|
|
|
|
AuthAPI --> JWT[JWT Service]
|
|
AuthAPI --> OAuth[OAuth Providers]
|
|
AuthAPI --> DB[(PostgreSQL)]
|
|
|
|
OAuth --> Google[Google OAuth 2.0]
|
|
OAuth --> GitHub[GitHub OAuth]
|
|
|
|
JWT --> Secret[Shared Secret]
|
|
JWT --> Validation[Token Validation]
|
|
|
|
DB --> Users[auth.users Table]
|
|
DB --> Providers[auth.user_providers]
|
|
|
|
style Client fill:#1e293b,stroke:#475569,color:#e2e8f0
|
|
style SDK fill:#1e40af,stroke:#3b82f6,color:#dbeafe
|
|
style AuthAPI fill:#166534,stroke:#22c55e,color:#dcfce7
|
|
style JWT fill:#c2410c,stroke:#fb923c,color:#fed7aa
|
|
style OAuth fill:#6b21a8,stroke:#a855f7,color:#f3e8ff
|
|
style DB fill:#0e7490,stroke:#06b6d4,color:#cffafe
|
|
style Secret fill:#991b1b,stroke:#ef4444,color:#fee2e2
|
|
style Google fill:#4c1d95,stroke:#8b5cf6,color:#ede9fe
|
|
style GitHub fill:#1e293b,stroke:#64748b,color:#f1f5f9
|
|
style Validation fill:#991b1b,stroke:#ef4444,color:#fee2e2
|
|
style Users fill:#0e7490,stroke:#22d3ee,color:#cffafe
|
|
style Providers fill:#0e7490,stroke:#22d3ee,color:#cffafe
|
|
```
|
|
|
|
## Features
|
|
|
|
### Email and password
|
|
|
|
The default. New users sign up with an email and password, get a confirmation email, and receive a session JWT on login. Password reset, email verification, and brute-force throttling are built in.
|
|
|
|
### Magic link and OTP
|
|
|
|
Send a one-time link or six-digit code to the user's email. Passwordless sign-in, account recovery, and step-up auth all use the same primitive.
|
|
|
|
### OAuth providers
|
|
|
|
First-class support for Google, GitHub, Apple, Microsoft, GitLab, Discord, and more. Add custom OAuth 2.0 / OIDC providers (Keycloak, Okta, Auth0, your own IdP) by URL without writing provider-specific code.
|
|
|
|
### OAuth server mode
|
|
|
|
Run InsForge itself as an OAuth 2.0 / OIDC identity provider for your own downstream apps. See the [OAuth Server guide](/oauth-server) for the full setup.
|
|
|
|
### Row-level security
|
|
|
|
The auth JWT flows through every InsForge SDK call automatically. Postgres RLS policies read claims from the token and decide, row by row, what the user can read and write. The same identity and the same policies apply whether the request hits the database, storage, or a realtime channel.
|
|
|
|
### `auth.users` in your database
|
|
|
|
User state lives in your project's Postgres database in the `auth` schema. Join `auth.users` to your application tables via foreign keys, react to identity changes with triggers, and back the whole thing up the same way you back up everything else.
|
|
|
|
## Build with it
|
|
|
|
<CardGroup cols={2}>
|
|
<Card title="TypeScript SDK" icon="js" href="/sdks/typescript/auth">
|
|
Sign up, log in, and manage sessions from Node, browser, and edge.
|
|
</Card>
|
|
|
|
<Card title="Swift SDK" icon="swift" href="/sdks/swift/auth">
|
|
Native Swift auth client for iOS and macOS.
|
|
</Card>
|
|
|
|
<Card title="Kotlin SDK" icon="android" href="/sdks/kotlin/auth">
|
|
Coroutines-first auth client for Android and JVM.
|
|
</Card>
|
|
|
|
<Card title="REST API" icon="code" href="/sdks/rest/auth">
|
|
Plain HTTP auth endpoints, callable from any language.
|
|
</Card>
|
|
</CardGroup>
|
|
|
|
## Next steps
|
|
|
|
- Set up the [CLI](/quickstart) to link your project (the recommended path).
|
|
- Browse the [TypeScript SDK reference](/sdks/typescript/auth) for sign-in patterns.
|