What is Authentication?

Checking who someone is, usually by signing in.

Where Authentication goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Into the app stores · 3 minutes · Pro
The reviewer who couldn't sign in
Your app signs people in with a six-digit code sent by email. Apple rejected it under Guideline 2.1: 'We were unable to sign in.'
Why can't the App Store reviewer sign in?
Reviewers only have the details you type into App Review Information. If your app signs in with email codes or magic links, they never receive the code. Create one review account that signs in with a fixed password or code, give it sample data and paid features, and keep it and your backend working until approval.
Read the fix
Launch day · 4 minutes · Pro
Sign in with Google: Error 400
'Sign in with Google' works perfectly on your laptop. On your real domain, users see 'Error 400: redirect_uri_mismatch'.
How do I fix Google redirect_uri_mismatch?
Add the exact callback URL your app uses in production to the allowed redirect URIs in Google Cloud Console and in your auth provider. It must match exactly, including https, domain, path and trailing slash. Google does not allow wildcards, so give each environment that needs sign-in a stable address.
Read the fix
Who may see what · 4 minutes · Free
Invoice 105
Your invoicing app is live. A customer emails: they changed a number in the address bar and saw someone else's invoice.
What is an IDOR vulnerability?
An IDOR (insecure direct object reference) is when an app loads a record by an id from the URL or request without checking that the signed-in user owns it. Changing /invoices/104 to /invoices/105 then shows someone else's invoice. The fix is to scope every query to the current user on the server.
Walk it, free
The life of a click · 4 minutes · Pro
Blocked by CORS
Your API works in Postman. In the browser: 'blocked by CORS policy'. Your AI has 'fixed' the frontend three times.
How do I fix 'blocked by CORS policy'?
Fix it on the server that answers the request, not in your frontend. Browsers send a preflight OPTIONS request first; the API must reply with headers allowing your site's origin and the headers you use. Allow only your own origins rather than everyone, and remember CORS is not authentication.
Read the fix
Who may see what · 4 minutes · Pro
Open it in incognito
Everything works when you are signed in. A security researcher emails: 'Try your API from a private window.'
How do I test my app for exposed data?
Test every page and API route as four people: signed out, a normal user, a different user, and an admin. Any endpoint that returns data or makes changes for someone who should be refused is a security bug. Testing only while signed in as yourself hides these bugs.
Read the fix
Teams and sharing · 4 minutes · Free
Removed, but still inside
You removed a contractor from your team at 2:00pm. At 2:40pm they downloaded the customer list.
Why can a removed user still access data?
If your security rules read the user's role from their sign-in token (JWT claims), the old role stays valid until that token expires, an hour by default in Supabase. Signing them out doesn't revoke a token already issued. Check team membership in the database inside your RLS policies, so every request sees the current team list.
Walk it, free

Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
API: The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
Secret key: A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.
Endpoint: One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.
Browser: Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

All 62 terms in the glossary

Where Authentication goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Into the app stores · 3 minutes · Pro

The reviewer who couldn't sign in

Your app signs people in with a six-digit code sent by email. Apple rejected it under Guideline 2.1: 'We were unable to sign in.'

Why can't the App Store reviewer sign in?

Reviewers only have the details you type into App Review Information. If your app signs in with email codes or magic links, they never receive the code. Create one review account that signs in with a fixed password or code, give it sample data and paid features, and keep it and your backend working until approval.

Read the fix

Launch day · 4 minutes · Pro

Sign in with Google: Error 400

'Sign in with Google' works perfectly on your laptop. On your real domain, users see 'Error 400: redirect_uri_mismatch'.

How do I fix Google redirect_uri_mismatch?

Add the exact callback URL your app uses in production to the allowed redirect URIs in Google Cloud Console and in your auth provider. It must match exactly, including https, domain, path and trailing slash. Google does not allow wildcards, so give each environment that needs sign-in a stable address.

Read the fix

Who may see what · 4 minutes · Free

Invoice 105

Your invoicing app is live. A customer emails: they changed a number in the address bar and saw someone else's invoice.

What is an IDOR vulnerability?

An IDOR (insecure direct object reference) is when an app loads a record by an id from the URL or request without checking that the signed-in user owns it. Changing /invoices/104 to /invoices/105 then shows someone else's invoice. The fix is to scope every query to the current user on the server.

Walk it, free

The life of a click · 4 minutes · Pro

Blocked by CORS

Your API works in Postman. In the browser: 'blocked by CORS policy'. Your AI has 'fixed' the frontend three times.

How do I fix 'blocked by CORS policy'?

Fix it on the server that answers the request, not in your frontend. Browsers send a preflight OPTIONS request first; the API must reply with headers allowing your site's origin and the headers you use. Allow only your own origins rather than everyone, and remember CORS is not authentication.

Read the fix

Who may see what · 4 minutes · Pro

Open it in incognito

Everything works when you are signed in. A security researcher emails: 'Try your API from a private window.'

How do I test my app for exposed data?

Test every page and API route as four people: signed out, a normal user, a different user, and an admin. Any endpoint that returns data or makes changes for someone who should be refused is a security bug. Testing only while signed in as yourself hides these bugs.

Read the fix

Teams and sharing · 4 minutes · Free

Removed, but still inside

You removed a contractor from your team at 2:00pm. At 2:40pm they downloaded the customer list.

Why can a removed user still access data?

If your security rules read the user's role from their sign-in token (JWT claims), the old role stays valid until that token expires, an hour by default in Supabase. Signing them out doesn't revoke a token already issued. Check team membership in the database inside your RLS policies, so every request sees the current team list.

Walk it, free

Related terms

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

API

The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.

Secret key

A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.

Endpoint

One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.

Browser

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.