# Authentication

## Overview

BOSA Core Authentication provides authentication solution that supports multi-tenancy authentication system. It offers a complete authentication system including client management, user authentication, and token handling. The system uses [JWT (JSON Web Tokens)](https://jwt.io/introduction) for secure authentication and [Argon2](https://pypi.org/project/argon2/) for password hashing.

<figure><img src="https://848217251-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FltWAQwLe6iVXF3rTPYsK%2Fuploads%2FJrZAZyQdXVGMGJIbbaRb%2FBOSA%20Core%20-%20Authentication_%20Component%20Diagram(1).png?alt=media&#x26;token=00711a25-e046-4115-aa57-4100f44ae22a" alt=""><figcaption><p>BOSA Core Auhentication's Component Diagram</p></figcaption></figure>

## Core Features

1. **Client Management**
   * Client creation and API key generation
   * Client-specific user isolation
2. **User Management**
   * User registration and authentication
   * Secure secret management using Argon2
   * User verification services
3. **Token Management**
   * JWT token generation and verification
   * Token expiration handling
   * Token revocation capabilities
4. **Multi-tenancy Support**
   * Complete data isolation between clients
   * Client-specific user management
   * Independent authentication flows per client
   * Client-scoped token validation
   * Custom security configurations per organization

## Core Process

{% stepper %}
{% step %}

### Client Creation

The authentication flow begins with Client creation using a Master Key:

1. **Client Creation**: A system administrator uses a Master Key to create a new Client
2. **Client API Key**: The system generates a unique API Key for the Client
3. **Client Storage**: Client information is securely stored in the database
   {% endstep %}

{% step %}

### User Management

Once a Client is established, it can manage its Users:

1. **User Creation**: A Client creates Users with unique identifiers
2. **User Secret**: The system generates or accepts a secret (password) for each User
3. **Secret Hashing**: User secrets are hashed using Argon2 before storage
4. **User Storage**: User information is securely stored in the database
   {% endstep %}

{% step %}

### Token Management

Authentication is performed through token issuance and verification:

1. **Token Creation**: Upon successful authentication, the system generates JWT tokens
2. **Token Verification**: These tokens are verified for subsequent requests
3. **Token Expiration**: Tokens expire after a configurable period (default: 43,200 minutes or 30 days)
4. **Token Revocation**: Tokens can be revoked by the system if needed
   {% endstep %}

{% step %}

### Third-Party Integrations

#### Third-Party Integrations <a href="#id-4-third-party-integrations" id="id-4-third-party-integrations"></a>

Users can extend their authentication to third-party systems:

1. **Integration Creation**: Users can create integrations with third-party connectors
2. **Auth String Storage**: The system securely stores authentication credentials for these integrations
3. **Scoped Access**: Each integration can be granted specific scopes of access
   {% endstep %}
   {% endstepper %}

## Next Steps:

* Start and run your first app [here](https://gl-docs.gitbook.io/bosa/bosa-sdk/bosa-core-sdk/authentication/quick-start) using Bosa Authentication
* Check our full example [here](https://github.com/GDP-ADMIN/bosa-example-apps/tree/main/bosa-authentication-example-app)
