Add authentication with AI by selecting a maintained identity solution and specifying every user state before generating integration code. Authentication proves identity; authorization decides what that identity may do. Your plan must cover both, and qualified review is warranted for production access.
Define sign-up or provisioning, sign-in, sign-out, session expiry, recovery, verification, account linking, deletion, and administrator actions. State which routes and records require which roles. Ask the agent to follow the current official documentation for your chosen provider and framework, using the exact installed versions. Keep secrets in managed configuration, validate redirect destinations, protect state-changing requests, and avoid storing sensitive tokens where application scripts can read them unnecessarily. Add tests for valid, expired, missing, tampered, and wrong-role sessions.
Review server-side enforcement independently from interface visibility. Hiding a button is not authorization. Confirm rate limits, logging hygiene, revocation, audit needs, and failure behavior. Test in separate development and production environments, and define how to disable the integration if deployment fails.
Begin with one protected route and one forbidden-role test. Inspect the generated diff and dependency changes, then expand flows gradually. AI can assemble the integration, but security comes from explicit trust boundaries, current provider guidance, adversarial tests, and humans who remain responsible for access policy. This is a design and review method, not a security certification or a guarantee that generated code is secure.
Source: OWASP Authentication Cheat Sheet; OWASP Authorization Cheat Sheet.
