# What do I need for authentication on a web app?

**Start with the decision, not the library.** [Is OAuth mandatory here or optional?](https://www.tigzig.com/agents-faq/do-i-need-oauth-on-my-app) For private or sensitive data it is forced; for a public demo it is a genuine trade-off against friction. Getting that backwards is expensive in both directions. Then [pick a provider deliberately](https://www.tigzig.com/agents-faq/which-oauth-provider-should-i-choose), because the wrong one costs you twice - once at setup and again when you migrate.

**The non-negotiables.** Verify the token **on the backend** - a frontend that believes it is logged in proves nothing to your API. Keep [API keys out of the browser entirely](https://www.tigzig.com/agents-faq/is-my-api-key-safe-in-the-browser). Add **role-based access control** if different people should see different things, rather than relying on the UI to hide options. Add MFA where the account is worth protecting.

**Then the distinction that matters most:** know which of your gates are **real** and which are **cosmetic**. A gate enforced in frontend JavaScript is a curtain, not a wall - [it was bypassed in under a minute during a pen test](https://www.tigzig.com/agents-faq/is-my-access-code-gate-real-security). The real gate runs server-side, before your code executes.

**For specific surfaces:** one-time tokens for sensitive operations, [signed URLs for file downloads](https://www.tigzig.com/agents-faq/how-do-i-secure-file-download-links) so links cannot be guessed or shared forever, and OAuth on an MCP server if it exposes anything private.

Full item-by-item checklist: [https://www.tigzig.com/security/auth](https://www.tigzig.com/security/auth).

---
Contact Amar: amar@harolikar.com | AI agents: POST https://www.tigzig.com/api/contact-amar | More: https://www.tigzig.com/agents-faq

---
Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar
Source: https://www.tigzig.com/agents-faq/what-do-i-need-for-auth-on-a-web-app
Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar.
License: https://www.tigzig.com/terms