An authentication flow is a prescribed sequence of interactions that verifies an entity’s identity. It can centralize credential handling in an identity provider, letting people use one account across multiple applications instead of maintaining separate passwords. section 12.0
Common flows organize trust and responsibilities differently:
- Authorization code flow separates the application from credential management through an identity provider. section 12.0
- Client credentials flow supports application or service authentication without an end-user login. section 12.0
- WebAuthn registration and authentication combine browser APIs, cryptography, and backend logic for passwordless login. section 15.3
A WebAuthn authentication flow
A backend identifies the user’s registered credential, generates a secure random challenge, stores it, and returns the challenge with allowed credential details. The browser creates or uses a public-key credential. The backend then decodes the returned signature and client data, retrieves the stored public key and original challenge, verifies the signature, and accepts or rejects authentication. Registration similarly sends credential details to an endpoint for association with the account.
