Auth & Identity

The territory

29 core terms mapped for this field, ranked by how often builders reach for them. Each one is a future entry. Want to bust one? One entry, one file, one pull request.

• OAuth 2.0delegated access protocol letting an app act on your behalf"OAuth" · "the permission handshake" · "let my app use their account"
• Single Sign-On (SSO)one login unlocks many apps across an organization"log in once for everything" · "company-wide login"
• Social loginsign in using an existing Google/GitHub/Apple account"that Continue with Google button" · "log in with Facebook"
• Magic linkpasswordless login via emailed one-time URL"email me a login link" · "no password, just click the email"
• Passkeyphone/laptop biometric replaces password, phishing-resistant"log in with FaceID instead of a password" · "the fingerprint login thing"
• Passwordless authenticationsigning in without a password: links, codes, or passkeys"get rid of passwords" · "no password login"
• Multi-factor authentication (MFA)second proof beyond password before access granted"2FA" · "the code from my phone" · "two-step login"
• Time-based one-time password (TOTP)6-digit code rotating every 30 seconds from a shared secret"authenticator app code" · "the Google Authenticator numbers" · "the code that keeps changing"
• Sessionserver-remembered login state tied to a cookie"staying logged in" · "the thing that expires and logs me out"
• Session timeoutlogin state expiring after elapsed or idle time"logged out for being idle" · "how long should logins last"
• Cookie flags (HttpOnly, Secure, SameSite)settings that stop scripts and sites from stealing sessions"make the cookie safe" · "the cookie settings nobody explains"
• JWT (JSON Web Token)signed self-contained token carrying user claims"that long random string in the header" · "the token my API checks"
• Bearer tokenwhoever holds the token gets the access"the Authorization header thing" · "paste the token to call the API"
• Refresh tokenlong-lived credential that silently mints new access tokens"so users don't get logged out" · "the thing that renews my login"
• Access token vs. refresh tokenshort-lived key for calls, long-lived key for renewal"why do I have two tokens"
• Refresh-token rotation and token revocationreplacing tokens on use and invalidating leaked ones"kill the stolen token" · "make old tokens stop working"
• Authentication vs. authorizationwho you are versus what you're allowed to do"logged in but not allowed" · "authn vs authz"
• Role-based access control (RBAC)permissions granted by named roles like admin/editor/viewer"admin vs regular user" · "permission levels"
• Organization / workspace membershipusers belonging to teams with per-team roles"invite teammates to my account" · "team accounts"
• Identity provider (IdP)the system that vouches for who a user is"whoever actually stores the logins"
• OpenID Connect (OIDC)identity layer on top of OAuth, returns an ID token"OAuth but for actually knowing who they are"
• Authorization Code Flow with PKCEsecure OAuth flow for browser and native apps"the safe OAuth flow" · "pixie" · "why my SPA login broke"
• Password hashing (bcrypt/argon2)one-way scrambling so stored passwords can't be read"never store the real password" · "the scrambled password"
• Account linkingmerging multiple sign-in methods into one user identity"same email, different login buttons" · "duplicate account problem"
• Email address verificationconfirming ownership of an address before granting access"the confirm your email step"
• Password reset flowtokenized, expiring path to set a new password"forgot password" · "the reset link"
• API keystatic secret identifying a machine caller, not a human"the string I paste in the settings" · "the developer token"
• Consent screen / scopesthe permission list a user approves during OAuth"this app wants access to..." · "the checkbox permissions page"
• Auth guard / protected routecode gate redirecting unauthenticated visitors to login"make this page members-only" · "kick them to the login page"

Deeper in the field

• SAML XML-based enterprise SSO protocol demanded by big customers
• SCIM auto-provisioning and deprovisioning users from a company directory
• SAML service provider and OIDC relying party protocol-specific names for the app trusting an identity provider
• ID token OIDC token carrying authenticated user identity claims
• OAuth redirect URI / callback URL registered destination receiving the authorization response
• Client ID and client secret credentials identifying an OAuth client application
• OAuth state parameter correlates requests and helps prevent OAuth login attacks
• One-time password (OTP) single-use code delivered by email, SMS, or authenticator
• Recovery codes one-time backup codes when the second factor is lost
• Account recovery regaining access after losing authentication factors
• Global sign-out invalidating all active sessions across every device
• Silent refresh renewing auth in the background without user interruption
• Step-up authentication re-prompting for MFA before a sensitive action
• WebAuthn the browser standard underneath passkeys and hardware keys
• Hardware security key physical USB/NFC device proving presence
• Trusted device recognition remembering a known device to skip repeat MFA
• Attribute-based access control (ABAC) permissions from user/resource attributes, not fixed roles
• Relationship-based access control (ReBAC) permissions derived from relationships between users and resources
• Permission / policy engine centralized service answering "can this user do that?"
• Identity federation trusting identities authenticated by another administrative domain
• Just-in-time (JIT) provisioning creating the account automatically on first SSO login
• Anonymous / guest user usable identity before signup, upgradeable later
• Domain verification and domain-based enrollment proving a company email domain, then auto-joining its users
• Invite flow invitations, pending states, and acceptance into a workspace
• Audit log (auth events) recorded trail of logins, role changes, and grants
• Machine-to-machine auth (client credentials) services authenticating without any user present
• Service account non-human identity a system uses to act
• mTLS (mutual TLS) both client and server prove identity with certificates
• Impersonation (login as user) staff safely assumes a user's session for support
• Age assurance and identity proofing establishing a person's age or real-world identity