Authentication
AM handles credential verification, password hashing, and magic links so you can focus on your app logic.
Choose the methods that fit your users—traditional passwords for enterprises or magic links for consumer apps.
Authentication Methods
Email + Password
Credentials hashed with PBKDF2. Users register with email and password, then authenticate with the same.
User ──▶ Email + Password ──▶ PBKDF2 Verify ──▶ Issue TokensMagic Links
Passwordless authentication via one-time email links. Users click the link to authenticate.
Password Reset
Secure recovery when users forget credentials:
- User requests reset via
/auth/send-password-reset - Time-limited token sent to verified email
- User sets new password via
/auth/reset-password
Token Lifetimes
| Token | Default | Purpose |
|---|---|---|
| Access Token | 1 hour | API authorization |
| Refresh Token | 14 days | Obtain new access tokens |
| CSRF Token | Session | Prevent cross-site attacks |
Lifetimes are configurable per client.
Security
- PBKDF2 Hashing: Industry-standard password storage
- Rate Limiting: Prevents brute force attacks
- CSRF Protection: Required for state-changing requests
- Secure Cookies: HttpOnly, Secure, SameSite options