Implementing Authentication with Claude Code

Authentication is one of the most consequential systems in any application. Get it wrong and the consequences range from data exposure to complete account takeover.

Claude Code accelerates auth implementation significantly, but only when the developer defines security requirements before generating a single line of code. The tool is fast at producing working auth.

It is not automatically correct for your specific threat model.

For the broader application context, see how to build a full-stack app with Claude Code. This guide covers what Claude Code generates reliably, the workflow that produces secure results, and common auth patterns by stack.

What Claude Code generates for authentication

Claude Code generates complete, functional authentication implementations across the three most common patterns. Understanding what it produces helps set the right expectations before you start.

JWT-based authentication

For stateless APIs and single-page applications, Claude Code generates:

• Token creation with configurable expiry and signing algorithms (HS256, RS256)
• Middleware for token validation on protected routes
• Refresh token rotation logic
• Token blacklisting patterns for logout flows

The output is production-shaped code, not pseudocode. A request like implement JWT authentication for this Express API with 15-minute access tokens and 7-day refresh tokens produces working middleware, route handlers, and token utilities in one pass.

Session-based authentication

For server-rendered applications where session management lives on the server:

• Session store configuration (in-memory for development, Redis for production)
• Login, logout, and session validation handlers
• CSRF protection middleware
• Cookie configuration with httpOnly, secure, and sameSite flags

Claude Code defaults to secure cookie configurations. Always review the generated sameSite and secure settings against your deployment environment before shipping.

OAuth flows

For third-party authentication via Google, GitHub, or other providers:

• Authorization code flow with state parameter generation
• Token exchange handlers
• User profile normalization across providers
• Account linking logic for users who sign in with multiple providers

The workflow: define requirements before generating

The most common mistake when using Claude Code for auth is opening a conversation and typing add authentication. The output will be functional, but it will reflect Claude’s assumptions about your security requirements rather than yours.

The correct workflow has four steps.

Step 1: Define your auth requirements

Before any code generation, document your requirements explicitly. Bring these into the Claude Code conversation as a structured prompt:

Auth requirements:
- User types: admin, standard, read-only
- Session duration: 24 hours (access), 30 days (refresh)
- MFA: required for admin accounts
- Password policy: min 12 chars, complexity required
- Rate limiting: 5 failed attempts = 15-minute lockout
- Audit logging: all auth events to audit table

This context shapes every generated file. The more specific the requirements, the less review and revision the output needs.

Step 2: Generate middleware and core auth logic

With requirements defined, generate the core authentication layer:

Based on the requirements above, generate:
1. Auth middleware for the Express API
2. User model with password hashing (bcrypt, cost factor 12)
3. Login and registration handlers
4. JWT utilities (create, verify, refresh)

Review each generated component against your requirements before proceeding.

Step 3: Generate route protection

Once the core auth layer is verified, generate route-level protection:

Generate protected route middleware that:
- Validates JWT on every request to /api/*
- Checks user role against required permissions
- Returns 401 for invalid tokens, 403 for insufficient permissions
- Logs auth failures to the audit table

Step 4: Generate and run test flows

Claude Code generates auth test suites as readily as it generates the implementation:

Generate integration tests covering:
- Successful login and token issuance
- Login with invalid credentials (rate limiting)
- Token expiry and refresh
- Access to protected routes by role
- Logout and token invalidation

Run the generated tests before considering the auth implementation complete.

Common auth patterns by stack

Next.js with NextAuth

NextAuth simplifies OAuth and session management for Next.js applications. Claude Code generates the full NextAuth configuration including provider setup, session callbacks, and database adapters.

Key generation prompt pattern:

Set up NextAuth for this Next.js 14 app with:
- Google OAuth provider
- Credentials provider (email/password)
- PostgreSQL adapter (prisma)
- Custom session fields (user role, org ID)
- Protected API routes using getServerSession

Claude Code generates the [...nextauth].ts route, the Prisma schema additions, and the session type extensions in one pass.

Express with Passport.js

Passport.js handles the strategy pattern for Express authentication. Claude Code generates:

• Strategy configuration for local (username/password) and OAuth strategies
• Session serialization and deserialization
• Route-level passport.authenticate() middleware
• The full middleware stack: express-session, passport.initialize(), passport.session()

The most common revision needed: adjusting the session store from the default in-memory store to Redis for production.

FastAPI with OAuth2

FastAPI’s built-in OAuth2 support combined with Python-Jose for JWT handling is a common pattern Claude Code handles well:

Implement OAuth2 password flow for this FastAPI app:
- JWT tokens with RS256 signing
- Role-based permission scopes
- Dependency injection for route protection
- Token refresh endpoint

Claude Code generates the security utilities, the token dependency, and the protected route pattern using FastAPI’s Depends() system.

Security checklist for generated auth code

Review every Claude Code auth implementation against this checklist before deployment.

What needs human judgment

Claude Code generates mechanically correct auth code. Several decisions still require developer judgment.

• Threat modeling. Claude Code does not know your specific attack surface. A consumer app with payment data has a different threat model than an internal tool. The auth implementation should reflect that threat model explicitly.
• Compliance requirements. HIPAA, SOC 2, PCI-DSS, and GDPR each impose specific requirements on authentication and session management. Claude Code generates standard implementations. Compliance-specific requirements must be specified explicitly and verified by someone who knows the standard.
• Key management. For RS256 JWT signing, the key rotation strategy is a business decision. Claude Code generates the code for key rotation. The rotation schedule and storage architecture are yours to define.

Frequently asked questions

Can Claude Code implement MFA?

Yes. TOTP-based MFA (Google Authenticator, Authy) is well within Claude Code’s generation capability. Specify MFA requirements in the initial prompt: which user types require it, whether it is enforced or optional, and what the backup code flow should look like.

WebAuthn (hardware key / biometric) is more complex but Claude Code can generate the server-side implementation against the W3C spec.

How do I handle auth for a monorepo with multiple apps?

Define a shared auth library as the generation target and instruct Claude Code to generate it as a reusable package. Include the interfaces for token payloads, user types, and middleware contracts in the prompt.

Individual apps then import the shared package rather than duplicating auth logic.

Does Claude Code output pass security audits?

Generated auth code provides a solid starting point, but a formal security audit evaluates your specific deployment context, infrastructure, and threat model. Use the security checklist table above as a pre-audit review.

For applications handling sensitive data or subject to compliance requirements, a dedicated security review is a separate step from code generation.

What is the most common auth bug in Claude Code output?

The most frequent issue is an overly permissive CORS configuration paired with credentials: 'include' in the frontend. Claude Code generates functional cross-origin auth, but the generated CORS origin setting often needs to be tightened from a wildcard (*) to an explicit origin list before production deployment.

Ready to ship secure authentication?

Generated auth code is a strong foundation. The architecture decisions, threat modeling, and compliance verification are the layers that make it production-ready.

For applications with strict data isolation requirements, the multi-tenant architecture guide covers how auth integrates with tenant-level isolation. The security best practices guide is also a useful companion reference for hardening generated auth code.

Path one: implement it yourself. Use the workflow above: define requirements first, generate middleware, run the security checklist, test the flows. The structure above works for solo developers and small teams building on standard stacks.

Path two: work with Phos AI Labs. We build production-ready authentication implementations using Claude Code as part of a structured development engagement. Requirements, generation, security review, and testing are handled together. Start with a discovery call.