Authentication Best Practices with Amen Identity

Authentication is critical for any web application. Amen centralizes it in Identity so a product never hosts its own password, provider-account or refresh-token database.

Identity supports password login, email OTP, magic links, recovery and configured social providers. The B2B console is an OIDC public client using authorization code with PKCE.

The Evolution of Auth

Authentication has evolved significantly:

• Passwords - Still common but increasingly problematic
• OAuth/Social Login - Delegating auth to trusted providers
• Magic Links - Passwordless email-based authentication
• Passkeys - The future of authentication

Use the OIDC boundary

The product redirects to Identity and spends the returned authorization code exactly once:

const result = await spendAuthorizationCode({
  code,
  codeVerifier,
  redirectUri,
});

session.adopt(result);
navigate({ to: "/orgs", replace: true });

The browser keeps access tokens in memory. An Identity token is sent only to Core; the Core-minted product token is sent only to the product API.

Passwordless delivery

OTP and magic-link messages are rendered and delivered by Identity through the shared Amen email transport:

1. User enters their email
2. Server generates a secure token
3. Email is sent with a login link
4. User clicks link and is authenticated

Session Management

Secure session handling is crucial:

• Use HTTP-only cookies
• Implement proper session expiration
• Support session revocation
• Consider refresh token rotation

Security Checklist

• Register an exact redirect URI and allowed origin
• Require PKCE and validate state on every authorization response
• Spend each authorization code once and remove it from browser history
• Rate limit authentication endpoints
• Implement CSRF protection
• Use secure cookie settings
• Log authentication events
• Implement account lockout