# Overview

Add sign-in, sign-out, and session management to your React app.

BuildBase handles authentication end-to-end. Wrap your app in `SaaSOSProvider`, use `useSaaSAuth()` for sign-in/sign-out, and `WhenAuthenticated`/`WhenUnauthenticated` to control what users see.

```tsx
import { useSaaSAuth } from '@buildbase/sdk/react';

function App() {
  const { user, isAuthenticated, signIn, signOut } = useSaaSAuth();

  if (!isAuthenticated)
    return <button onClick={() => signIn()}>Sign In</button>;
  return <p>Welcome, {user.name}</p>;
}
```

> **Note:**
  Enable at least one auth method in the BuildBase dashboard before integrating.


## Supported auth methods


| Method         | Description                                              |
| -------------- | -------------------------------------------------------- |
| Email/Password | Traditional credential-based sign-in                     |
| Magic Link     | Passwordless email link — one click to authenticate      |
| Passkeys (WebAuthn) | Phishing-resistant sign-in with device biometrics or security keys |
| Google OAuth   | Sign in with Google accounts                             |
| LinkedIn OAuth | Sign in with LinkedIn profiles                           |
| GitHub OAuth   | Sign in with GitHub accounts                             |
| Microsoft OAuth | Sign in with Microsoft accounts                          |
| API Tokens     | Server-to-server authentication for backend integrations |


Enable or disable any method from the dashboard — no code changes needed.

## OAuth 2.0 authorization server

Beyond first-party sign-in, every BuildBase app is a full OAuth 2.0 authorization server. Third-party apps and AI agents request scoped access to user accounts through the standard authorization code flow:

- **Dynamic client registration** — clients register programmatically (RFC 7591/7592)
- **Token introspection** — resource servers validate tokens (RFC 7662)
- **Token revocation** — clients invalidate tokens (RFC 7009)
- **PKCE** — proof key for code exchange, including public clients (CLIs, agents, SPAs)
- **User consent** — users approve a client's requested scopes before it gets access

Scopes and resources are defined by your app. No extra setup is needed — the endpoints are live for every BuildBase app.

## Available hooks and components

**Hook:**

- `useSaaSAuth()` — Current user, sign-in, sign-out, session status, and `openWorkspaceSettings()`.

**Components:**

- `WhenAuthenticated` — Render children only when signed in.
- `WhenUnauthenticated` — Render children only when not signed in.

```tsx
import { WhenAuthenticated, WhenUnauthenticated } from '@buildbase/sdk/react';

function Page() {
  return (
    <>
      <WhenAuthenticated>
        
      </WhenAuthenticated>
      <WhenUnauthenticated>
        
      </WhenUnauthenticated>
    </>
  );
}
```

## Next Steps

- [Sign In & Sign Out](/authentication/sign-in-sign-out) — `useSaaSAuth()` return values and usage patterns.
- [Protected Routes](/authentication/protected-routes) — Guard routes based on auth state.