User Authentication
User authentication in Frontier is designed for human users accessing your application through a web browser or mobile app. Frontier provides multiple authentication strategies that you can enable and configure based on your application’s needs.Supported Authentication Strategies
Frontier supports the following user authentication strategies:- Social Login (OIDC) - Google, GitHub, Facebook, and other OIDC providers
- Email OTP - One-time password sent via email
- Magic Links - Passwordless login via email link
- Passkeys - WebAuthn-based biometric and hardware key authentication
Listing Available Strategies
Before presenting login options to users, query Frontier to get the list of enabled authentication strategies:Social Login (OIDC)
Social login allows users to authenticate using their existing accounts from providers like Google, GitHub, or Facebook.Configuration
Configure OIDC providers in yourconfig.yaml:
Setting Up Google OIDC
Visit the Google Cloud Console and create a new project.
Authentication Flow
curl --location 'http://localhost:7400/v1beta1/auth/register/google?callback_url=https://frontier.example.com/v1beta1/auth/callback&return_to=https://app.example.com/dashboard' \
--header 'Accept: application/json'
{
"endpoint": "https://accounts.google.com/o/oauth2/v2/auth?client_id=...&redirect_uri=...",
"state": "flow-uuid-here"
}
Frontier automatically processes this callback, verifies the code, and creates/retrieves the user.
Set-Cookie: frontier-session=encrypted-session-data; HttpOnly; Secure; SameSite=Lax
Location: https://app.example.com/dashboard
Complete Example
- Frontend (React)
- Backend (Go)
Email One-Time Password (OTP)
Email OTP provides passwordless authentication by sending a one-time code to the user’s email.Configuration
Authentication Flow
curl --location 'http://localhost:7400/v1beta1/auth/register/[email protected]' \
--header 'Accept: application/json'
curl --location 'http://localhost:7400/v1beta1/auth/callback?code=123456&state=flow-uuid-here' \
--header 'Accept: application/json'
Security Features
- Rate Limiting - Maximum 3 OTP verification attempts per flow
- Time Expiration - OTP expires after 10 minutes (configurable)
- Constant-Time Comparison - Prevents timing attacks
- Flow Consumption - OTP can only be used once
Example Implementation
- Frontend
Magic Links
Magic links provide one-click authentication via email.Configuration
Authentication Flow
Passkey Authentication
Passkeys provide modern, phishing-resistant authentication using WebAuthn.Features
- Biometric authentication (fingerprint, face recognition)
- Hardware security keys (YubiKey, etc.)
- Platform authenticators (Touch ID, Windows Hello)
- No passwords to remember
Flow
curl --location 'http://localhost:7400/v1beta1/auth/register/[email protected]' \
--header 'Accept: application/json'
Request Verification
After successful authentication, you can verify requests in two ways:1. Session Cookie (Recommended)
The session cookie is automatically included in requests:2. Access Token
Request an access token after authentication:Logout
To end a user’s session:Multi-Organization Support
Frontier is multi-tenant aware. Each organization can have different authentication requirements:Best Practices
Use HTTPS in Production
Use HTTPS in Production
Always use HTTPS in production to protect session cookies and tokens.
Implement CSRF Protection
Implement CSRF Protection
Frontier includes CSRF protection. Ensure your frontend handles CSRF tokens properly.
Whitelist Callback URLs
Whitelist Callback URLs
Only allow trusted callback URLs to prevent open redirect vulnerabilities.
Set Appropriate Token Validity
Set Appropriate Token Validity
Use short-lived access tokens and longer-lived refresh tokens.
Related Documentation
Sessions
Learn about session management and lifecycle
Service Users
Authenticate machine users and services