---

What is Authentication?

Authentication is the process of verifying who a user is. AuthSafe handles authentication using industry-standard protocols to ensure your users can securely access your applications. When a user logs in through AuthSafe:

1. They provide their credentials (email/password, social login, etc.)
2. AuthSafe verifies their identity
3. Your application receives proof of authentication
4. The user gains access to protected resources

---

How AuthSafe Works

• 1. User Initiates Login

  User clicks "Login" in your application. Your app redirects them to AuthSafe's authorization endpoint with your client ID and requested scopes.

• 2. User Authenticates

  AuthSafe presents a login page where users enter credentials. We support password-based auth, social logins, and enterprise SSO.

• 3. Authorization Code Issued

  After successful authentication, AuthSafe redirects back to your app with a secure authorization code. This code is short-lived and single-use.

• 4. Tokens Exchanged

  Your backend exchanges the authorization code for access tokens and ID tokens. These tokens prove the user's identity and permissions.

---

OAuth 2.0 & OpenID Connect

AuthSafe implements both OAuth 2.0 (for authorization) and OpenID Connect (for authentication).

OAuth 2.0

OAuth 2.0 is an authorization framework that enables applications to obtain limited access to user resources without exposing credentials. Key Benefits:

• Delegated access without sharing passwords
• Fine-grained permissions through scopes
• Secure token-based authentication
• Industry-standard protocol

OpenID Connect (OIDC)

OpenID Connect is an identity layer built on top of OAuth 2.0. It adds user authentication and profile information. What OIDC Adds:

• User identity verification (ID tokens)
• Standardized user profile information
• Session management
• Discovery and dynamic client registration

---

Token Types

AuthSafe issues different types of tokens for different purposes:

---

Security Features

PKCE (Proof Key for Code Exchange)

PKCE is required for all authorization code flows in AuthSafe. It prevents authorization code interception attacks. How PKCE Works:

1. Your app generates a random code_verifier
2. Creates a code_challenge by hashing the verifier (SHA-256)
3. Sends the challenge with the authorization request
4. Sends the verifier when exchanging the code for tokens
5. AuthSafe validates that the verifier matches the original challenge

Token Security

• RS256 Signing: All tokens are signed with RSA-256 using organization-specific keys
• Token Validation: Always verify token signatures using our JWKS endpoint
• HTTPS Only: All API endpoints require secure connections
• Token Expiration: Access tokens expire after 1 hour by default
• Token Revocation: Refresh tokens can be revoked at any time

Session Management

• Secure Sessions: Sessions are stored server-side with encryption
• Session TTL: Configurable time-to-live for user sessions
• Single Logout: Support for RP-initiated logout across all sessions
• Concurrent Sessions: Control how many active sessions a user can have

---

Authentication Flows

---

Next Steps