# How FusionAuth Works

Learn the core concepts of FusionAuth, how FusionAuth fits into your login flow, and the plans and limits that shape an integration.

> For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt)

FusionAuth handles login for your applications. Your app sends users to FusionAuth to log in, and FusionAuth sends them back with tokens your app can trust.

Here's a typical application login flow before FusionAuth:

```mermaid
sequenceDiagram
    participant User
    participant App as Application

    User ->> App : View Homepage
    User ->> App : Click Login Link
    App ->> User : Show Login Form
    User ->> App : Fill Out and Submit Login Form
    App ->> App : Authenticates User
    App ->> User : Display User's Account or Other Info
```

Request flow during login before FusionAuth

And here's the same application login flow after introducing FusionAuth:

```mermaid
sequenceDiagram
    participant User
    participant App as Application
    participant FusionAuth

    User ->> App : View Homepage
    User ->> App : Click Login Link (to FusionAuth)
    User ->> FusionAuth : View Login Form
    FusionAuth ->> User : Show Login Form
    User ->> FusionAuth : Fill Out and Submit Login Form
    FusionAuth ->> FusionAuth : Authenticates User
    FusionAuth ->> User: Go to Redirect URI
    User ->> App: Request the Redirect URI
    App ->> FusionAuth : Is User Authenticated?
    FusionAuth ->> App : User is Authenticated
    App ->> User : Display User's Account or Other Info
```

Request flow during login after FusionAuth

Legacy identity technologies have complex hierarchy and cryptic terminology like realms, principals, subjects and distinguished names. In order to simplify something perceived to be complex, the best approach is to go back to the basics, to the atomic elements and throw everything else away.

When we built FusionAuth we took the back to basics approach. We identified two atomic elements of identify, Users and Applications. Everyone has Users, and Users need to be authenticated to Applications. For this reason FusionAuth is built upon four core elements:

*   Users - someone that can log into things
*   Applications - things that Users log into
*   Registrations - the connection between a User and an Application they have access to
*   Tenants - A way to logically isolate Applications, Users and Registrations

## Users

A user is uniquely identified in any particular tenant by an email address or username. [Learn more.](https://fusionauth.io/docs/concepts/types/users.md)

## Applications

A FusionAuth Application represents an authenticated resource such as a web application, mobile application or any other application that requires authenticated users. A FusionAuth Application is defined by a name and a set of Roles. [Learn more.](https://fusionauth.io/docs/concepts/types/applications.md)

## Registrations

A User can be registered to one or more FusionAuth Applications. A User Registration can define one to many Application Roles. [Learn more.](https://fusionauth.io/docs/concepts/types/registrations.md)

## Tenants

Tenants are way to separate Users, Applications and Registrations into separate containers. Inside a Tenant, you can define any number of Users, Applications and Registrations. Across Tenants, you can define duplicate Applications, Users and Registrations.

For example, you might have two Tenants and inside both Tenants you might have an Application named `Web Based Payroll` and a User with the email address `john@piedpiper.com`. Each of these Users might have a Registration to the `Web Based Payroll` Application. And finally, each of these Users might have different passwords and data. [Learn more.](https://fusionauth.io/docs/concepts/types/tenants.md)

## Learn More

[Authentication and Authorization Learn about the difference between authentication and authorization in FusionAuth.](https://fusionauth.io/docs/concepts/authentication-authorization.md)

[Identity Providers Learn how FusionAuth delegates login to external identity providers.](https://fusionauth.io/docs/concepts/identity-providers.md)

[Integration Points Learn about how FusionAuth integrates with existing or new applications.](https://fusionauth.io/docs/concepts/integration-points.md)

[Localization and Internationalization Learn about localization, translations and internationalization in FusionAuth.](https://fusionauth.io/docs/concepts/localization-and-internationalization.md)

[OAuth Scopes Learn about the OAuth scopes FusionAuth supports and how applications request them.](https://fusionauth.io/docs/concepts/scopes.md)

Related

[Concepts Core Types Learn about the core types in FusionAuth and how they interact to manage authentication and authorization. applicationsuserstenants](https://fusionauth.io/docs/concepts/types.md)

[Concepts Integration Points Learn about how FusionAuth integrates with existing or new applications. login flow](https://fusionauth.io/docs/concepts/integration-points.md)

[Users Users Learn how to register, verify, manage, and provision users in FusionAuth. users](https://fusionauth.io/docs/users.md)