Authentication System

Overview

The ONE Platform Authentication System provides enterprise-grade user authentication with six different methods. Users can sign up and sign in using email/password, OAuth social login, passwordless magic links, or two-factor authentication.

Supported Methods

1. Email/Password

Traditional sign up with email and password. Password hashed with bcrypt, strength requirements enforced.

import { authClient } from '@/lib/auth';

const result = await authClient.signUp({
email: '[email protected]',
password: 'SecurePassword123!',
name: 'John Doe'
});

if (result.error) {
console.error(result.error.message);
} else {
console.log('User created:', result.data.user);
}

2. OAuth Social Login

One-click authentication with popular OAuth providers:

import { authClient } from '@/lib/auth';

export function SocialLogin() {
const handleGoogleSignIn = async () => {
  await authClient.signIn.social({
    provider: 'google',
    callbackURL: '/dashboard'
  });
};

return (
  <button onClick={handleGoogleSignIn}>
    Sign in with Google
  </button>
);
}

3. Magic Link Passwordless

One-click email authentication. No password required, ultra-secure.

import { authClient } from '@/lib/auth';

const result = await authClient.magicLink.send({
email: '[email protected]',
callbackURL: '/dashboard'
});

if (result.success) {
alert('Check your email for the magic link!');
}

4. Two-Factor Authentication

High-security login with additional verification:

• SMS verification codes
• Authenticator apps (TOTP)
• Backup codes

import { authClient } from '@/lib/auth';

// Enable 2FA for current user
const result = await authClient.twoFactor.enable({
method: 'totp' // or 'sms'
});

// Returns QR code for authenticator app
console.log(result.data.qrCode);
console.log(result.data.backupCodes);

import { authClient } from '@/lib/auth';

// Verify 2FA code during login
const result = await authClient.twoFactor.verify({
code: '123456'
});

if (result.success) {
console.log('2FA verified, user authenticated');
}

5. Email Verification

Verify email ownership during sign up. Can be required or optional per organization.

6. Password Reset

Secure account recovery via email with time-limited reset links.

Security Features

• Password Hashing: bcrypt with cost factor 12
• Session Tokens: JWT with 30-day expiration
• Rate Limiting: Brute force protection
• HTTPS Only: All auth endpoints TLS-encrypted
• CSRF Protection: Token-based CSRF prevention
• Audit Trail: Complete event logging

Pricing Calculator

Multi-Tenant Architecture

Each organization has isolated authentication:

• Separate user directories
• Per-organization password policies
• Custom OAuth providers
• Isolated session tokens

All scoped via groupId in the database.

Next Steps

Ready to add enterprise authentication to your app?

See individual feature pages for specific authentication methods and advanced configuration options.