> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.openfort.io/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

# Authentication Methods

At a high level, onboarding users onchain breaks down into three core questions: who is taking the onchain action (the user), through what means are they able to control this action (the signer), and where is the affected state (the account).

**With Openfort, your app can authenticate users, including:**

* **Email**: via password or one-time passcode (OTP)
* **Phone**: via SMS one-time passcode (OTP)
* **Wallet**: via Sign In With Ethereum ([SIWE](https://eips.ethereum.org/EIPS/eip-4361)) standard
* **Web2 social accounts**: via [OAuth2.0 Protocol](https://oauth.net/2/) (Google, Facebook, Twitter, Discord, and more)
* **Guest**: anonymous authentication that can be upgraded later

These methods can be configured as either login or link options for users. Once authenticated, Openfort creates a common `User` object that includes the user's ID and profile information, treating all users equally regardless of their authentication method.

## Choosing an authentication method

| Method | Description | Best for |
| --- | --- | --- |
| **Email & Password** | Traditional credentials-based sign up and login | Familiar UX, broad compatibility |
| **Email OTP** | Passwordless login via one-time code sent to email | Low-friction onboarding |
| **Phone OTP** | Passwordless login via one-time code sent via SMS | Mobile-first apps |
| **Social / OAuth** | Google, Apple, Facebook, X, Discord, and more | Consumer apps, fast sign-up |
| **Wallet (SIWE)** | Connect external wallets (MetaMask, WalletConnect) via Sign In With Ethereum | Crypto-native users |
| **Guest** | Anonymous authentication that can be upgraded later | Try-before-you-register flows |
| **Third-party** | Firebase, Supabase, Auth0, and custom auth systems | Existing auth infrastructure |

## Response types

All authentication methods across all SDKs return a common response structure containing the session token and user information.

### AuthResponse

```typescript
interface AuthResponse {
  token: string | null   // Session token for authentication
  user: User             // User profile information
  session?: Session      // Optional session details
}
```

### User

```typescript
interface User {
  id: string                   // Unique user identifier
  email?: string               // User's email address
  name?: string                // User's display name
  image?: string               // URL to user's profile image
  emailVerified?: boolean      // Whether email has been verified
  createdAt?: string           // ISO timestamp when created
  updatedAt?: string           // ISO timestamp when last updated
  isAnonymous?: boolean        // Whether user is anonymous (guest)
  phoneNumber?: string         // User's phone number
  phoneNumberVerified?: boolean // Whether phone has been verified
  linkedAccounts?: UserAccount[] // Linked accounts (external wallets and auth providers only, not embedded wallets)
}
```

### Session

```typescript
interface Session {
  id?: string           // Session identifier
  token: string         // Session token for authentication
  userId: string        // User ID associated with this session
  expiresAt?: string    // ISO timestamp when session expires
  createdAt?: string    // ISO timestamp when created
}
```

### Example response

```json
{
  "user": {
    "id": "usr_cc9ed2b7-c5f5-4c43-8dca-c4b104ba1762",
    "email": "hello@example.com",
    "name": "John Doe",
    "emailVerified": true,
    "createdAt": "2024-03-20T12:00:00Z",
    "updatedAt": "2024-03-20T12:00:00Z",
    "isAnonymous": false
  },
  "token": "eyJhbGci...",
  "session": {
    "id": "ses_...",
    "token": "eyJhbGci...",
    "userId": "usr_cc9ed2b7-c5f5-4c43-8dca-c4b104ba1762",
    "expiresAt": "2024-03-21T12:00:00Z",
    "createdAt": "2024-03-20T12:00:00Z"
  }
}
```

The SDK automatically stores tokens after successful authentication.

## Configure authentication

* [Social login providers](https://www.openfort.io/docs/configuration/social-login) - Set up Google, Apple, Facebook, and other OAuth providers
* [External auth providers](https://www.openfort.io/docs/configuration/external-auth) - Configure Firebase, Supabase, and other third-party systems
* [Password settings](https://www.openfort.io/docs/configuration/password/security) - Customize password policies and email templates

## SDK implementations

* [React](https://www.openfort.io/docs/products/embedded-wallet/react/auth) — @openfort/react. React hooks for authentication.
* [React Native](https://www.openfort.io/docs/products/embedded-wallet/react-native/auth) — @openfort/react-native. React Native hooks for authentication.
* [iOS](https://www.openfort.io/docs/products/embedded-wallet/swift/auth/email) — @openfort/swift. iOS authentication methods.
* [Unity](https://www.openfort.io/docs/products/embedded-wallet/unity/auth/email) — OpenfortSDK. Unity authentication methods.