# Authentication

Learn how users and clients log in with FusionAuth, and how FusionAuth acts as an identity provider for other applications.

> For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt)

FusionAuth logs users in with many methods. Start with the decision that shapes the rest of your integration: use the [hosted login pages or the Login API](#hosted-login-pages-or-the-login-api). Most apps use the hosted login pages with [OAuth and OpenID Connect](https://fusionauth.io/docs/authentication/oauth.md).

Then add the login methods your users need:

*   Passwordless login with [passkeys](https://fusionauth.io/docs/authentication/passkeys.md) or [one-time passwords](https://fusionauth.io/docs/authentication/one-time-passwords.md).
*   A second factor with [multi-factor authentication](https://fusionauth.io/docs/authentication/multi-factor-authentication.md).
*   Login through Google, Apple, an enterprise directory, or another [identity provider](https://fusionauth.io/docs/authentication/identity-providers.md).
*   [Single sign-on](https://fusionauth.io/docs/authentication/sessions/single-sign-on.md) across your applications.

To let other applications log users in through FusionAuth, see [Host a SAML v2 Identity Provider](https://fusionauth.io/docs/authentication/act-as-an-idp/host-saml-idp.md), and the integration guides for [OpenID Connect](https://fusionauth.io/docs/authentication/act-as-an-idp/oidc.md) and [SAML v2](https://fusionauth.io/docs/authentication/act-as-an-idp/saml.md).

## Hosted Login Pages or the Login API

With the hosted login pages, your app redirects the browser to FusionAuth, and FusionAuth renders login, registration, MFA, and the other login steps. With the [Login API](https://fusionauth.io/docs/authentication/login-api.md), your app renders every screen and calls FusionAuth behind the scenes. You can mix both, for example hosted login for the browser and the API for a custom step.

### Hosted Login Pages

Hosted login pages suit most apps. You customize the look with the [Simple Theme editor](https://fusionauth.io/docs/theme/simple-theme-editor.md), or with [Apache FreeMarker templates](https://fusionauth.io/docs/theme/advanced-themes.md) for full control. The browser has to redirect to FusionAuth.

![A diagram showing Apache FreeMarker side by side with FusionAuth's Simple Theme editor.](https://fusionauth.io/img/articles/hosted-vs-api/simple-vs-freemarker.png)

| Pros | Cons |
| --- | --- |
| Managed by experts. | Look and feel customization uses Freemarker unless you use Simple Themes. |
| No sensitive credentials seen by your application. | Browser redirect is required. |
| Fully custom look and feel. | Mobile devices use the system browser, not native UX components. See the image below this chart for an example. |
| Handles multiple use cases (account creation, MFA prompting, etc.) | Does not leverage React or other common design systems. Might require additional work from your design team. |
| Includes single sign-on (SSO) between different apps. | Updates can be problematic unless you're using Simple Themes. |
| Localization support. | Limited workflow customization. |
| New workflows added regularly so you gain function without added development work. |  |
| Doesn't exclude API usage. You can add custom logic such as redirects or requiring MFA for certain groups. |  |

On mobile, hosted login pages open in the system browser, so the address bar and browser controls stay visible. The following image shows the mobile login experience for [Audacy](https://audacy.com):

![Example of a FusionAuth Hosted Login Page](https://fusionauth.io/img/articles/hosted-vs-api/built-with-fusionauth.png)

### Login API

The Login API gives you full control over every element of the login UI. That control comes with responsibilities, listed in the following table.

| Pros | Cons |
| --- | --- |
| A fully custom login experience, with support for embedded flows such as iframe, modals, overlays, and native application UI elements. | Must build your own UI for auth related cases, often requiring several API calls per use case. |
| Browser not required. | Doesn't follow OAuth or OIDC standards. |
| No redirection for the user. | Your application will see sensitive user credentials. |
| You are able to build custom workflows to suit your business needs. For example, asking for an email on one screen, a password on another and requesting MFA on a third. | You must handle all session management. |
|  | You build it, you maintain it. |
|  | You are responsible for implementing new FusionAuth functions when they are released. |
|  | You must ensure that you handle every Login API status code correctly and securely. |
|  | By default, the Login API requires an API key. |

## In This Section

[Application Authentication Tokens Leverage Application specific authentication tokens to speed up certain authentication tasks.](https://fusionauth.io/docs/authentication/application-authentication-tokens.md)

[Authentication Types Learn about the supported types of authentication.](https://fusionauth.io/docs/authentication/authentication-types.md)

[Login Page Cookies Learn about the cookies set by FusionAuth.](https://fusionauth.io/docs/authentication/cookies.md)

Related

[Concepts Identity Providers Learn how FusionAuth delegates login to external identity providers. identity providerssamloidc](https://fusionauth.io/docs/concepts/identity-providers.md)

[APIs Identity Provider API Learn about the APIs for creating, retrieving, updating and deleting identity providers. samloauth](https://fusionauth.io/docs/apis/identity-providers.md)

[APIs OpenID Connect API Learn about the APIs for creating, retrieving, updating and deleting OpenID Connect identity providers. oidcoauth](https://fusionauth.io/docs/apis/identity-providers/openid-connect.md)

[Authentication Authentication Types Learn about the supported types of authentication. oauthsaml](https://fusionauth.io/docs/authentication/authentication-types.md)