Authentication & Authorization Patterns

When to Use

• Implementing login, signup, or logout flows for web applications
• Setting up JWT access tokens and refresh token rotation
• Building OAuth2 integrations (Google, GitHub, or custom providers)
• Adding role-based or permission-based access control to API endpoints
• Protecting routes with middleware guards in Next.js, Express, or FastAPI

When NOT to Use

• Public-only APIs that require no identity verification (e.g., open data endpoints)
• Internal services secured entirely at the network level (VPC, service mesh mTLS) with no application-layer auth
• Static sites with no user-specific content or server-side logic

Core Patterns