Authentication

Authentication is one prompt away. Tell the generator how strict you need to be — JWT, session cookies, refresh tokens, social login — and it wires the right pieces across the backend and frontend.

What you get out of the box

• JWT access tokens with optional refresh-token rotation.
• Password hashing with bcrypt or argon2.
• Email verification and password-reset flows.
• OAuth social login — Google, GitHub, Microsoft. Configure client IDs in .env.
• Role-based authorization middleware (requireRole('admin')) and protected routes on the frontend.

Example prompt

"Add email/password auth with email verification, plus Google login.
 Only admins can open the /settings page."

You get the register/login/verify endpoints, token handling, the Google OAuth flow, and a route guard that redirects non-admins away from settings.

Adding roles and permissions

1. Name your roles — "add roles: owner, manager, staff".
2. Say what each can do — "only owners can delete; staff are read-only on reports".
3. The AI adds the checks on both the API (middleware) and the UI (guards and hidden controls).

Generated mobile apps

• If you generate a React Native app, the same auth APIs are reused.
• The generated mobile client stores tokens in secure storage and refreshes silently on a 401 — you don't build auth twice.

Common mistakes to avoid

• Building wide open, securing later. Start strict — say "require login" early; loosening is easier than retrofitting.
• Trusting the client for authorization. Hiding a button isn't security — the API must enforce roles too (it does by default).
• Storing tokens insecurely. Use the generated secure-storage patterns rather than plain local storage for sensitive apps.

FAQ