> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.openfort.io/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

# Authentication Methods

Openfort authentication is the identity layer for Openfort embedded wallets. It signs a user in, returns a session token and a `User` object, and provisions a non-custodial embedded wallet bound to that identity. You can let Openfort own login, or keep the identity provider you already run and hand Openfort the JWT it issues. Every method produces the same `User` object and the same embedded wallet, so the method a user signs in with doesn't change how your application treats them afterwards.

Openfort supports authentication through email and password, email one-time passcode, SMS one-time passcode, social login with Google, Apple, X (Twitter), Discord, Facebook, Line, and Epic Games, wallet login with Sign-In with Ethereum (SIWE), guest accounts that upgrade to permanent ones later, and any existing authentication system that issues a JWT, including Firebase, Supabase, Better-Auth, Auth0, Amazon Cognito, PlayFab, AccelByte, LootLocker, and any OpenID Connect (OIDC) provider.

## Authentication methods by SDK

Each cell names the hook or method that performs the method in that SDK. The per-SDK pages linked under [SDK implementations](#sdk-implementations) carry the full signatures.

| Method | React | React Native | JavaScript | Swift | Unity | Backend |
| --- | --- | --- | --- | --- | --- | --- |
| Email and password | `useEmailAuth` | `useEmailAuth` | `signUpWithEmailPassword` | `signUpWithEmailPassword` | `SignUpWithEmailPassword` | Verify |
| Email OTP | `useEmailOtpAuth` | `useEmailAuthOtp` | `requestEmailOtp` | `requestEmailOtp` | `RequestEmailOtp` | Verify |
| SMS OTP | `usePhoneOtpAuth` | `usePhoneAuthOtp` | `requestPhoneOtp` | Not documented | `RequestPhoneOtp` | Verify |
| Google | `useOAuth` | `useOAuth` | `initOAuth` | `initOAuth` | Third-party auth only | Verify |
| Apple | `useOAuth` | `useOAuth` | `initOAuth` | `loginWithIdToken` | Third-party auth only | Verify |
| X (Twitter) | `useOAuth` | `useOAuth` | `initOAuth` | `initOAuth` | Third-party auth only | Verify |
| Discord | `useOAuth` | `useOAuth` | `initOAuth` | `initOAuth` | Third-party auth only | Verify |
| Facebook | `useOAuth` | `useOAuth` | `initOAuth` | `initOAuth` | Third-party auth only | Verify |
| Line | `useOAuth` | `useOAuth` | `initOAuth` | `initOAuth` | Third-party auth only | Verify |
| Epic Games | `useOAuth` | `useOAuth` | `initOAuth` | `initOAuth` | Third-party auth only | Verify |
| Wallet login (SIWE) | `useWalletAuth` | `useWalletAuth` | `loginWithSiwe` | `authenticateWithSIWE` | `LoginWithSiwe` | Verify |
| Custom OIDC or JWT | `thirdPartyAuth` | `thirdPartyAuth` | `thirdPartyAuth` | `thirdParty` | `LogInWithIdToken` | Token accepted |
| Guest | `useGuestAuth` | `useGuestAuth` | `signUpGuest` | `signUpGuest` | `SignUpGuest` | Verify |
| Passkeys | Wallet recovery only | Wallet recovery only | Wallet recovery only | Wallet recovery only | Not supported | Not applicable |

Five qualifications apply to the table, and each one changes the answer for a specific SDK:

* **Backend means verification, not login.** The Openfort backend SDK never starts an end-user login. It verifies the session any client method produces with `openfort.iam.getSession`, described in [User session and authorization](https://www.openfort.io/docs/products/embedded-wallet/server/access-token). For custom OIDC or JWT, the backend also accepts the provider's token directly on an API call through the `x-auth-provider` and `x-player-token` headers.
* **Unity has no built-in social login.** OAuth flows aren't available with Openfort's built-in authentication in Unity. To offer social login in a Unity game, authenticate with a [third-party provider](https://www.openfort.io/docs/products/embedded-wallet/unity/auth/third-party) such as Firebase and pass the resulting JWT to Openfort.
* **Passkeys recover wallets, they don't log users in.** A passkey encrypts the embedded wallet's recovery share, so the user restores the wallet on a new device with Face ID, Touch ID, or a device unlock. See [Embedded wallet recovery methods](https://www.openfort.io/docs/configuration/recovery-methods). The Unity SDK doesn't support passkey recovery.
* **Sign in with Apple on iOS is native.** The Swift SDK uses `loginWithIdToken` with an Apple ID credential rather than the browser-based OAuth flow. See [Sign in with Apple](https://www.openfort.io/docs/products/embedded-wallet/swift/auth/sign-in-with-apple).
* **Wallet login in React is Ethereum-only.** `useWalletAuth` requires a wagmi provider. Every other authentication method is chain-agnostic and works the same for Ethereum and Solana.

The Swift SDK documentation covers no SMS one-time passcode flow, so that cell reads "Not documented" rather than claiming support.

### Social login providers

The React, React Native, JavaScript, and Swift SDKs accept the same seven `OAuthProvider` values. Enable each provider in the [Openfort Dashboard](https://dashboard.openfort.io/providers) before use, following [Configure social login](https://www.openfort.io/docs/configuration/social-login).

| Provider | Enum value |
| --- | --- |
| Google | `GOOGLE` |
| Apple | `APPLE` |
| X (Twitter) | `TWITTER` |
| Discord | `DISCORD` |
| Facebook | `FACEBOOK` |
| Line | `LINE` |
| Epic Games | `EPIC_GAMES` |

## Choosing an authentication method

| Method | Description | Best for |
| --- | --- | --- |
| **Email and password** | Credentials-based signup and login | Familiar UX, broad compatibility |
| **Email OTP** | Passwordless login with a one-time passcode sent by email | Low-friction onboarding |
| **SMS OTP** | Passwordless login with a one-time passcode sent by SMS | Mobile-first apps |
| **Social login** | Google, Apple, X (Twitter), Discord, Facebook, Line, and Epic Games | Consumer apps, fast signup |
| **Wallet login (SIWE)** | External wallets such as MetaMask and WalletConnect | Crypto-native users |
| **Guest** | Anonymous account that upgrades to a permanent one later | Try-before-you-register flows |
| **Third-party authentication** | Firebase, Supabase, Auth0, Amazon Cognito, and custom auth servers | Existing login infrastructure |

## Bring your own authentication provider

Openfort calls this *third-party authentication*. Your provider stays the source of truth for identity. Openfort verifies the JWT it issues and binds an embedded wallet to the user identifier inside that token, so you keep your existing login and your existing users.

The exchange has three steps:

1. The user signs in with your provider, such as Firebase or Auth0.
2. Your application reads the current provider token through a `getAccessToken` callback you supply when you initialize Openfort.
3. Openfort verifies the token against the provider configuration you set in the dashboard, then provisions or restores the embedded wallet.

Configure the provider in the [Openfort Dashboard](https://dashboard.openfort.io/providers) first. An OIDC provider needs its audience (`aud`) value plus a JWKS URL or a PEM-encoded public key. A custom auth server needs a verification endpoint that Openfort calls.

| Provider | `ThirdPartyOAuthProvider` value | Required configuration |
| --- | --- | --- |
| [Firebase](https://www.openfort.io/docs/configuration/external-auth/firebase) | `FIREBASE` | Project ID |
| [Supabase](https://www.openfort.io/docs/configuration/external-auth/supabase) | `SUPABASE` | Project URL and API key |
| [Better-Auth](https://www.openfort.io/docs/configuration/external-auth/better-auth) | `BETTER_AUTH` | Base URL of the Better-Auth instance |
| [PlayFab](https://www.openfort.io/docs/configuration/external-auth/playfab) | `PLAYFAB` | Title ID |
| [AccelByte](https://www.openfort.io/docs/configuration/external-auth/accelbyte) | `ACCELBYTE` | Base URL, client ID, and client secret |
| [LootLocker](https://www.openfort.io/docs/configuration/external-auth/lootlocker) | `LOOTLOCKER` | None beyond enabling it |
| [Custom OIDC](https://www.openfort.io/docs/configuration/custom-auth/oidc-token) | `OIDC` | Audience, plus a JWKS URL or a public key |
| [Custom auth server](https://www.openfort.io/docs/configuration/custom-auth/auth-token) | `CUSTOM` | Verification URL and optional request headers |

Auth0 and Amazon Cognito connect through the `OIDC` value, as does any other OpenID Connect provider. The React, React Native, and JavaScript SDKs support every value in this table. The Swift and Unity SDKs support every value except `BETTER_AUTH`.

:::warning
Third-party authentication replaces Openfort's login UI. `OpenfortButton` and the `uiConfig` settings on `OpenfortProvider` apply to Openfort-managed authentication only, so you build your own login screens.
:::

Per-SDK setup lives in [Using your own authentication](https://www.openfort.io/docs/products/embedded-wallet/react/auth/third-party) for React, [Third-party authentication](https://www.openfort.io/docs/products/embedded-wallet/react-native/auth/third-party) for React Native, [Third-party auth providers](https://www.openfort.io/docs/products/embedded-wallet/javascript/auth/external-auth) for JavaScript, [Third-party authentication](https://www.openfort.io/docs/products/embedded-wallet/swift/auth/third-party) for Swift, and [Third-party authentication](https://www.openfort.io/docs/products/embedded-wallet/unity/auth/third-party) for Unity.

## Account linking and unlinking

A user can hold several authentication methods on one account and one embedded wallet. Prompt them to link an additional account at any point in their journey, not only at login.

Email is the identity key. Within a project environment, any sign-in carrying an email address Openfort has already seen resolves to the existing user and their existing embedded wallet, so a user who signs up with an address and later signs in with Google on that same address lands on the same account without any linking call.

Three flows produce a separate user and a separate wallet, so you must link them explicitly:

* The provider returns no email. X (Twitter) omits it unless your app holds elevated API access.
* The provider returns a different email, such as an Apple Private Relay address.
* The user signs in with a wallet through SIWE, which carries no email to match on.

| Action | JavaScript method |
| --- | --- |
| Link an email address | `addEmail` |
| Link a social account | `initLinkOAuth` |
| Link a phone number | `linkPhoneOtp` |
| Link an external wallet | `initLinkSiwe`, then `linkWithSiwe` |
| Unlink a social account | `unlinkOAuth` |
| Unlink an external wallet | `unlinkWallet` |

:::warning
Linking requires an active session, so it only works going forward. Calling a linking method doesn't merge two accounts that already exist or move assets between their wallets. Prompt users to link at sign-in, before a second wallet exists.
:::

Full signatures and examples are in [Linking and unlinking accounts](https://www.openfort.io/docs/products/embedded-wallet/javascript/auth/user-management/linking).

## Response types

All authentication methods across all SDKs return a common response structure containing the session token and user information.

### AuthResponse

```typescript
interface AuthResponse {
  token: string | null   // Session token for authentication
  user: User             // User profile information
  session?: Session      // Optional session details
}
```

### User

```typescript
interface User {
  id: string                   // Unique user identifier
  email?: string               // User's email address
  name?: string                // User's display name
  image?: string               // URL to user's profile image
  emailVerified?: boolean      // Whether email has been verified
  createdAt?: string           // ISO timestamp when created
  updatedAt?: string           // ISO timestamp when last updated
  isAnonymous?: boolean        // Whether user is anonymous (guest)
  phoneNumber?: string         // User's phone number
  phoneNumberVerified?: boolean // Whether phone has been verified
  linkedAccounts?: UserAccount[] // Linked accounts (external wallets and auth providers only, not embedded wallets)
}
```

### Session

```typescript
interface Session {
  id?: string           // Session identifier
  token: string         // Session token for authentication
  userId: string        // User ID associated with this session
  expiresAt?: string    // ISO timestamp when session expires
  createdAt?: string    // ISO timestamp when created
}
```

### Example response

```json
{
  "user": {
    "id": "usr_cc9ed2b7-c5f5-4c43-8dca-c4b104ba1762",
    "email": "hello@example.com",
    "name": "John Doe",
    "emailVerified": true,
    "createdAt": "2024-03-20T12:00:00Z",
    "updatedAt": "2024-03-20T12:00:00Z",
    "isAnonymous": false
  },
  "token": "eyJhbGci...",
  "session": {
    "id": "ses_...",
    "token": "eyJhbGci...",
    "userId": "usr_cc9ed2b7-c5f5-4c43-8dca-c4b104ba1762",
    "expiresAt": "2024-03-21T12:00:00Z",
    "createdAt": "2024-03-20T12:00:00Z"
  }
}
```

The SDK stores tokens automatically after a successful authentication.

## Configure authentication

* [Social login providers](https://www.openfort.io/docs/configuration/social-login) - Set up Google, Apple, Facebook, and the other OAuth providers
* [External auth providers](https://www.openfort.io/docs/configuration/external-auth) - Configure Firebase, Supabase, and other third-party systems
* [Password settings](https://www.openfort.io/docs/configuration/password/security) - Customize password policies and email templates
* [Recovery methods](https://www.openfort.io/docs/configuration/recovery-methods) - Choose how the embedded wallet's recovery share is encrypted

## SDK implementations

* [React](https://www.openfort.io/docs/products/embedded-wallet/react/auth) — @openfort/react. React hooks for authentication.
* [React Native](https://www.openfort.io/docs/products/embedded-wallet/react-native/auth) — @openfort/react-native. React Native hooks for authentication.
* [JavaScript](https://www.openfort.io/docs/products/embedded-wallet/javascript/auth) — @openfort/openfort-js. JavaScript authentication methods.
* [iOS](https://www.openfort.io/docs/products/embedded-wallet/swift/auth/email) — @openfort/swift. iOS authentication methods.
* [Unity](https://www.openfort.io/docs/products/embedded-wallet/unity/auth/email) — OpenfortSDK. Unity authentication methods.