Start with the decision, not the library. Is OAuth mandatory here or optional? For private or sensitive data it is forced; for a public demo it is a genuine trade-off against friction. Getting that backwards is expensive in both directions. Then pick a provider deliberately, because the wrong one costs you twice - once at setup and again when you migrate.
The non-negotiables. Verify the token on the backend - a frontend that believes it is logged in proves nothing to your API. Keep API keys out of the browser entirely. Add role-based access control if different people should see different things, rather than relying on the UI to hide options. Add MFA where the account is worth protecting.
Then the distinction that matters most: know which of your gates are real and which are cosmetic. A gate enforced in frontend JavaScript is a curtain, not a wall - it was bypassed in under a minute during a pen test. The real gate runs server-side, before your code executes.
For specific surfaces: one-time tokens for sensitive operations, signed URLs for file downloads so links cannot be guessed or shared forever, and OAuth on an MCP server if it exposes anything private.
Full item-by-item checklist: https://www.tigzig.com/security/auth.
← All Agents FAQ