User Authentication

Some apps need to know who's using them. This guide covers when you need authentication and the simplest approaches to implement it.

When You Need Auth

You need auth when:

• Users have personal data (their notes, their settings)
• Content should be private
• You need to identify who did what
• Features differ by user

You don't need auth when:

• Tool is stateless (input → output)
• All users see the same content
• No personal data is stored
• It's a simple utility

Ask yourself:

"Does this app need to remember anything about specific users?"

If no, skip auth. It adds complexity.

Simple Approaches

Magic links (easiest)

User enters email, receives a login link, clicks to authenticate.

Add magic link authentication.
User enters email, receives a link, clicking the link logs them in.

Pros:

• No passwords to manage
• Familiar to users
• Hard to get wrong

Cons:

• Requires email service
• Slight friction (check email)

OAuth (social login)

"Sign in with Google/Apple/GitHub"

Pros:

• Users don't create new passwords
• Trusted providers handle security
• Quick to implement with libraries

Cons:

• Dependent on external providers
• Some users prefer not to link accounts

Password-based

Traditional username/password.

Add email and password authentication.
Include password reset functionality.

Pros:

• Users understand it
• No external dependencies

Cons:

• Must handle password security properly
• Password reset is complex
• Users forget passwords

Auth Services

These handle the hard parts for you:

Clerk

• Drop-in components
• Handles everything
• Good free tier

Auth0

• Enterprise-ready
• Extensive features
• More complex setup

Supabase Auth

• Part of Supabase platform
• PostgreSQL integration
• Good for full-stack apps

Firebase Auth

• Google's solution
• Multiple providers
• Good documentation

Prompting for auth setup

Add authentication using [Clerk/Auth0/Supabase].
Set up sign up, sign in, and sign out.
Protect [these routes/features] for logged-in users only.

What Auth Gives You

User identity

• Know who's logged in
• Associate data with users
• Personalize experience

Protected routes

• Some pages require login
• Redirect unauthorized users
• Show/hide features based on auth state

Session management

• Remember logged-in users
• Handle logout
• Token refresh

Implementation Patterns

Auth state in UI

Show the user's name in the header when logged in.
Show "Sign in" button when logged out.

Protected pages

Redirect to login if user tries to access [page] without being logged in.
After login, redirect back to the page they wanted.

Auth-dependent features

Only show the "Save" button if the user is logged in.
If not logged in, show a prompt to sign in.

Storing User Data

Profile information

Store the user's profile (name, avatar, preferences)
in [database/Supabase/Firebase].
Load it when they log in.

User-specific content

Each user should only see their own [notes/projects/items].
Filter the data by the logged-in user's ID.

Settings

Save user preferences (theme, notification settings)
associated with their account.

Privacy Considerations

Collect only what you need

• Don't ask for data you won't use
• Email is often enough to start

Be transparent

• Tell users what you collect
• Provide a privacy policy
• Allow data export/deletion

Handle data carefully

• Use HTTPS everywhere
• Don't log sensitive data
• Consider data retention

Prompting for privacy

Make sure authentication follows privacy best practices.
Don't store unnecessary data.
Use secure connections.

Common Auth Flows

Sign up

1. User enters email (+ password or magic link)
2. Verify email
3. Create account
4. Log them in

Sign in

1. User enters credentials
2. Verify credentials
3. Create session
4. Redirect to app

Sign out

1. User clicks logout
2. Destroy session
3. Redirect to home/login

Password reset

1. User requests reset
2. Send email with reset link
3. User clicks link
4. User sets new password

Debugging Auth Issues

User can't log in

Users are getting stuck at login.
[Describe what happens]
Error: [paste if available]

Session not persisting

Users keep getting logged out.
The session isn't being saved properly.

OAuth errors

Sign in with [provider] is failing.
Error: [paste error]
Here's my OAuth configuration: [describe]

What You'll Learn

• When authentication is necessary
• Different auth approaches and trade-offs
• Using auth services
• Protecting routes and features
• Storing user-specific data
• Privacy considerations

Exercises

1. For an app idea of yours, answer "Does this app need to remember anything about specific users?" and decide whether it needs auth at all — write down your reasoning.
2. Add authentication to a project using one auth service (Clerk, Supabase, or Firebase) with the setup prompt, wiring up sign up, sign in, and sign out.
3. Protect one route or feature so it's only visible to logged-in users, then test the redirect-back-after-login flow with the protected-pages prompt.