Authentication Methods
Email & Password
Traditional email and password authentication with secure password hashing.
Social Login
One-click login with Google and GitHub OAuth providers.
Magic Links
Passwordless authentication via email links.
API Keys
Server-to-server authentication for backend integrations.
Email & Password
The most common authentication method. Users register with their email and a secure password.Password Requirements
- Minimum 8 characters
- At least one uppercase letter
- At least one lowercase letter
- At least one number
Social Login
Enable users to sign in with their existing Google or GitHub accounts.Google Login
GitHub Login
Social login providers must be configured in your project settings before use.
Configuring OAuth Providers
- Go to Settings > Social Sign-On in your dashboard
- Enable the desired provider (Google or GitHub)
- Add your OAuth credentials:
- Google: Client ID and Client Secret from Google Cloud Console
- GitHub: Client ID and Client Secret from GitHub Developer Settings
- Add the sites users sign in from under Allowed Redirect URLs
Magic Links
Passwordless authentication sends a secure link to the user’s email.redirectTo domain, which must be one of your allowed redirect URLs.
Session Management
Check Authentication Status
Listen for Auth Changes
Refresh Session
Sessions are automatically refreshed before expiry. You can also manually refresh:Logout
Password Reset
Request Reset
Confirm Reset
Security Best Practices
Use HTTPS
Use HTTPS
Always serve your application over HTTPS to protect authentication tokens in transit.
Secure Password Storage
Secure Password Storage
Gately uses bcrypt with salt rounds for secure password hashing. Never store plain-text passwords.
Token Expiry
Token Expiry
Access tokens expire after 1 hour by default. Refresh tokens are valid for 7 days.
Register Your Redirect URLs
Register Your Redirect URLs
Social login, magic links, and password resets only redirect to URLs your project owns. Add every site users sign in from under Allowed Redirect URLs.
Verify Tokens on Your Server
Verify Tokens on Your Server
Never trust a session token your backend receives without checking it. Use
verifyToken or the Verify Token endpoint with a secret API key.Rate Limiting
Rate Limiting
Authentication endpoints are rate-limited to prevent brute force attacks.