What is authentication?
Authentication is the process of verifying identity: proving that the person signing in is who they claim to be. It's the front door of any app with private content, user accounts, or personal data, and everything protected sits behind it.
Common methods include email and password, magic links sent to an inbox, third-party sign-in ("Continue with Google" or Apple), and passkeys that use a device's biometrics. Most modern apps offer more than one.
How does authentication differ from access control?
Authentication establishes who someone is; access control (also called authorization) decides what that person may do. A signed-in user is authenticated, but whether they can see another user's records, edit shared data, or reach an admin page is an access-control question.
The distinction matters practically because passing the first check doesn't imply the second. A frequent flaw in vibe-coded apps is an app that authenticates users and then lets any of them fetch anyone's data, authentication without access control.
Why does authentication matter in vibe coding?
AI tools build the happy path first, and an app without login is simpler to generate, so authentication tends to be missing until the builder asks for it. Any app storing personal data or private content needs it before real users arrive, not after.
The good news is that nobody builds this from scratch anymore. Auth providers like Clerk, Auth0, Supabase Auth, and Firebase Authentication supply sign-up, sign-in, sessions, and password recovery as a service, and AI tools integrate them well from a single request. Asking for "authentication with a managed provider" gets battle-tested security; asking the AI to invent its own login system gets a liability.
