Authentication.

Authentication is the process of checking that a user, device or service is really who or what it claims to be before allowing access. In most apps, authentication happens when a user signs in with an email and password, enters a one-time code, clicks a magic link, uses Google or Apple login, or approves access with a passkey or fingerprint. Authentication is not the same as authorization. Authentication confirms who the user is, while authorization decides what that user is allowed to see or do. A complete authentication system may also handle account registration, email verification, password resets, session expiry, logout, account recovery and extra security checks for sensitive actions. For most MVPs, it is safer to use a trusted authentication service instead of creating passwords, tokens and login security from scratch. However, the developer must still configure sessions, redirects, database access and user permissions correctly.

Authentication protects private accounts, customer information and restricted parts of an application. Weak login, password-reset or session systems can allow attackers to take over accounts or access information that should be private. It also affects the product experience. Authentication should be secure without making it unnecessarily difficult for legitimate users to sign in, recover their accounts or complete important actions.