Authentication

Add sign-in to your Flutter app with type-safe APIs: email and social login across Google, Apple, GitHub, Facebook, and Microsoft, with managed sessions and scoped access, all in Dart.

Get Started

Built-in authentication

Building authentication yourself means managing token storage, provider SDKs, session expiry, and secure password hashing, and a mistake in any of them is a security risk. Serverpod handles identity on the server: it stores users and sessions, integrates the providers, and exposes the result through the same generated, type-safe client as the rest of your API.

You protect an endpoint with a single override, read the signed-in user from the session, and gate access with scopes. The Flutter side gets drop-in sign-in and a session manager that keeps the user signed in across restarts and devices.

How it works

1Enable the providers you need

Register the identity providers your app needs when the server starts. Each provider is a single config object.

pod.initializeAuthServices(
  tokenManagerBuilders: [serverSideSessionsConfig],
  identityProviderBuilders: [
    EmailIdpConfig(
      secretHashPepper: pod.getPassword('emailSecretHashPepper')!,
    ),
    googleIdpConfig,
    appleIdpConfig,
  ],
);

2Require a signed-in user

Set requireLogin on an endpoint, and Serverpod rejects unauthenticated calls before your code runs.

class ProfileEndpoint extends Endpoint {
  @override
  bool get requireLogin => true;

  Future<String> currentUserId(Session session) async {
    return session.authenticated!.userIdentifier;
  }
}

3Drop in the sign-in UI

The SignInWidget renders buttons for every provider you enabled, wired to your Serverpod client.

SignInWidget(
  client: client,
  onAuthenticated: _onSignedIn,
  onError: _onError,
);

Social sign-in

Turn on the providers your app needs, including Google, Apple, GitHub, Facebook, Microsoft, and Firebase.

Email and password

Full email sign-up with verification, secure password hashing, and password reset flows, without writing a single line of authentication code yourself.

Managed sessions

Serverpod issues revocable auth keys and keeps users signed in across app restarts through the client session manager. Set it up once when you create your client, and revoke a device or all sessions at any time.

final client = Client(serverUrl)
  ..connectivityMonitor = FlutterConnectivityMonitor()
  ..authSessionManager = FlutterAuthSessionManager();

await client.auth.initialize();

Scoped access

Use scopes to restrict access to a specific set of users with requireLogin and requiredScopes. Authorization lives next to the code it protects.

Everything included

Why Serverpod

Works with

Google Apple GitHub Facebook Microsoft Firebase

Frequently asked questions