Skip to main content
Gately supports multiple authentication methods to fit your application’s needs.

Authentication Methods

Email & Password

Traditional email and password authentication with secure password hashing.

Social Login

One-click login with Google and GitHub OAuth providers.

Magic Links

Passwordless authentication via email links.

API Keys

Server-to-server authentication for backend integrations.

Email & Password

The most common authentication method. Users register with their email and a secure password.

Password Requirements

  • Minimum 8 characters
  • At least one uppercase letter
  • At least one lowercase letter
  • At least one number

Social Login

Enable users to sign in with their existing Google or GitHub accounts.

Google Login

GitHub Login

Social login providers must be configured in your project settings before use.

Configuring OAuth Providers

  1. Go to Settings > Social Sign-On in your dashboard
  2. Enable the desired provider (Google or GitHub)
  3. Add your OAuth credentials:
    • Google: Client ID and Client Secret from Google Cloud Console
    • GitHub: Client ID and Client Secret from GitHub Developer Settings
  4. Add the sites users sign in from under Allowed Redirect URLs
See Social Login for the callback URLs to register with Google and GitHub. Passwordless authentication sends a secure link to the user’s email.
The user clicks the link in their email and is automatically logged in. The link is built on your redirectTo domain, which must be one of your allowed redirect URLs.

Session Management

Check Authentication Status

Listen for Auth Changes

Refresh Session

Sessions are automatically refreshed before expiry. You can also manually refresh:

Logout

Password Reset

Request Reset

Confirm Reset

Security Best Practices

Always serve your application over HTTPS to protect authentication tokens in transit.
Gately uses bcrypt with salt rounds for secure password hashing. Never store plain-text passwords.
Access tokens expire after 1 hour by default. Refresh tokens are valid for 7 days.
Social login, magic links, and password resets only redirect to URLs your project owns. Add every site users sign in from under Allowed Redirect URLs.
Never trust a session token your backend receives without checking it. Use verifyToken or the Verify Token endpoint with a secret API key.
Authentication endpoints are rate-limited to prevent brute force attacks.