January 2022 Summaries

Next.js API routes enable developers to build scalable serverless backend endpoints alongside React frontends, and the tutorial demonstrates creating a `/api/whoami` endpoint that initially returns placeholder data before adding authentication. Using SWR, a React component fetches and displays endpoint data, while PropelAuth integrates hosted login, signup, account management, and optional features such as social or passwordless authentication. The frontend is wrapped in an `AuthProvider`, and authenticated requests include a PropelAuth access token in the Authorization header through the `withAuthInfo` higher-order component. On the backend, PropelAuth’s Express middleware validates tokens locally and populates `req.user`, allowing the API route to return the authenticated user ID or reject unauthenticated requests with a 401 error. The example also adds conditional login, signup, and logout controls, and notes that PropelAuth can support B2B applications through organization membership, role-based access, organization selection tools, and middleware that verifies organizational membership.

FastAPI is a Python framework for rapidly building APIs, with dependency injection enabling authentication data to be supplied directly to route handlers. PropelAuth has introduced first-class FastAPI support alongside its existing Python and Flask options, providing configurable login, signup, account management, organization features, transactional emails, and compatibility with frontends such as Webflow and Next.js. Its FastAPI integration can reject requests without valid access tokens and inject authenticated user information into endpoints, while also supporting B2B authorization checks for organization membership and specific permissions. A related guide demonstrates building a secure application using a React frontend, FastAPI backend, and PropelAuth authentication.

A Next.js authentication tutorial demonstrates how to build an application with user signup, login, account management, social authentication such as Google login, passwordless magic links, and profile-picture uploads using PropelAuth. PropelAuth provides hosted and configurable authentication pages, transactional emails, optional two-factor authentication, user metadata collection, and B2B organization features, allowing developers to avoid implementing these systems themselves. The frontend integrates the `@propelauth/react` package through an AuthProvider, which manages authentication state, tokens, and user information, while React helpers and hooks enable conditional UI, login, signup, account redirects, and logout behavior. Authenticated frontend requests send bearer access tokens to Next.js API routes, where the `@propelauth/node` library validates JWT access tokens and retrieves user data, returning unauthorized responses when validation fails. The approach enables a Next.js application to securely identify users in backend operations, such as storing data associated with a user ID, with relatively little custom authentication code.

A tutorial demonstrates how to build a React and FastAPI application with user signup, login, account management, profile-picture uploads, Google social login, passwordless authentication, and optional organization support using PropelAuth. PropelAuth supplies hosted, configurable authentication pages and handles features such as transactional emails, two-factor authentication, user metadata, and token management, while React integrates through the @propelauth/react AuthProvider, authentication-aware components, redirect hooks, and access tokens for protected API requests. The FastAPI backend uses the propelauth-fastapi library to validate JWT access tokens through a dependency that protects routes such as a who-am-I endpoint, returning unauthorized responses when no valid token is present. The guide also addresses local cross-origin requests through a React proxy configuration and emphasizes that this approach provides a functional authenticated application with relatively little custom authentication code.

A tutorial demonstrates how to build a React and Flask application with user signup, login, account management, Google social login, passwordless authentication, profile-picture uploads, and optional organization support using PropelAuth. PropelAuth supplies hosted authentication pages and configurable features such as branding, signup metadata, multifactor authentication, transactional emails, and B2B organization management, while the React frontend integrates its SDK through an AuthProvider, user-information wrappers, redirect hooks, and automatically managed access tokens. The frontend sends bearer tokens with authenticated API requests and can use a development proxy to address cross-origin port differences. On the Flask side, the propelauth-flask library initializes authentication using environment-based credentials, protects routes with a require_user decorator, validates JWT access tokens locally after startup configuration, and exposes the authenticated user ID through a request-scoped current_user value.

PropelAuth can add hosted signup, login, account-management, and optional organization-management functionality to Webflow projects without requiring an initial backend, while supporting features such as social sign-on, passwordless links, profile pictures, custom signup metadata, and B2B organization tools. After creating and configuring a PropelAuth project, developers select Webflow as the frontend environment, add the PropelAuth JavaScript client to their page, and create logged-in and logged-out interface elements with IDs for actions such as signup, login, logout, and profile access. The client redirects users to hosted authentication pages, retrieves authentication status and user data, updates the page to show the appropriate content and profile image, and refreshes state when login status changes. PropelAuth uses secure HTTP-only cookies and requires a custom domain in production to prevent third-party cookie issues, while also allowing authentication to continue if a project later moves between Webflow and frameworks such as Next.js or React.

A tutorial demonstrates how to build a React and Express application with user signup, login, account management, Google social login, passwordless authentication, two-factor authentication, and profile-picture uploads through PropelAuth. PropelAuth supplies hosted, customizable authentication and account pages, optional organization features, transactional emails, and configuration for signup metadata and identity providers. On the React side, the application installs the PropelAuth library, wraps the app in an AuthProvider, uses injected authentication data such as the user profile and access token, provides login, signup, account, and logout redirects, and sends bearer tokens with authenticated backend requests. The guide also addresses local development CORS by configuring a proxy between React and Express. On the Express side, it creates a basic API route and then protects it with PropelAuth middleware that validates JWT access tokens, returns unauthorized errors when appropriate, and exposes the authenticated user through the request object, allowing applications to associate backend data with individual user IDs.

PropelAuth has expanded its authentication and user-management platform with optional signup fields for first name, last name, and username, along with user-uploaded profile pictures managed through hosted account pages. Developers can access this information through the user object in PropelAuth’s APIs and React SDK, enabling straightforward features such as displaying profile images and personalized welcome messages. The platform also supports account linking, coworker invitations, and social-login integrations, retrieving profile data from providers such as Google when available and prompting users for missing requested information when necessary. For passwordless authentication, users supply any configured profile details as part of completing signup.

PropelAuth announced its acceptance into Y Combinator’s Winter 2022 batch and reflected on its origin in the challenge of managing software complexity. Founded after its creator struggled to find an authentication service that was both complete and easy to use for a side project, the company aims to prevent developers from having to handle authentication’s underlying complexities themselves. PropelAuth offers configurable, hosted authentication interfaces, built-in features such as two-factor authentication, and libraries designed around a minimal API, allowing teams to implement branded user authentication quickly while retaining flexibility for more sophisticated applications.

PropelAuth emphasizes its commitment to platform data security through protections including two-factor authentication, passwordless login options, brute-force attack detection, and common-password detection. To validate these measures independently, the company engaged a security firm to audit its service, reporting that the assessment found no issues to disclose.

PropelAuth has introduced passwordless login support to address common password-related issues such as forgotten credentials, password reuse, weak or burdensome requirements, and brute-force risks. Its existing password system includes breached-password detection, NIST-based requirements, brute-force protection, and two-factor authentication, while passwords remain available for users who prefer familiar or password-manager-supported sign-in flows. With passwordless enabled, users enter their email address and receive a magic link that logs them in when clicked; the option can be disabled with one click, and password-reset screens can also offer a passwordless link. New PropelAuth projects will have both password and passwordless authentication enabled by default, while existing projects can activate the feature through the dashboard.