←  All terms
A
Security & Compliance

Authentication

Authentication verifies the identity of a user or system, for example with a password, passkey, or multi-factor method.

Authentication verifies the identity of a user or system, for example with a password, passkey, or multi-factor method. The appropriate design depends on the data, risk, and jurisdiction and requires both technical and organizational review. The concept is closely related to Authorization and Single Sign-On.

Read more

Authorization

Single Sign-On

Web Application

OAuth

FAQ

Authentication

When does single sign-on make sense for authentication?
Single sign-on makes sense when employees use several systems and central identity management should control access. When a person leaves, access is revoked in one place. The central identity provider does become a critical dependency, however, and needs strong protection.
Are passkeys an alternative to password-based authentication?
Passkeys are an alternative because they rely on public-key cryptography and transmit no secret that can be intercepted or phished. Devices, account recovery, and fallback methods still need planning. Many services therefore introduce passkeys alongside passwords first. A full switchover is therefore a process, not a switch.
When is multi-factor authentication worthwhile?
Multi-factor authentication pays off wherever a stolen password would cause serious damage, such as admin access, editorial systems, and customer accounts holding sensitive data. The price is slightly more friction at login. Where risk is low, the effort for users can outweigh the benefit.
What is the difference between authentication and authorization?
Authentication answers who someone is, authorization what that identity may do. A login only proves identity, not permission for specific data. Both steps are implemented and tested separately, because a flaw in either one opens access to the wrong content.