Glossary
On this page
A
- Access Token
- A credential that an application sends to an API to show that the request is authorized.
- Advanced Registration Forms
- Forms that let you build multi-step registration and admin user management flows for your applications.
- API Key
- A credential used to authenticate administrative requests to the FusionAuth API.
- Application
- A software program that your users log in to through FusionAuth.
- Audit Log
- A record of administrative actions taken within FusionAuth.
B
- Basic Authentication
- An HTTP authentication protocol transmitting credentials as base64-encoded username and password pairs.
- Also called: Basic Auth, HTTP Basic Authentication
- Defined in: RFC 7617
- Bcrypt
- A password hashing algorithm supported by FusionAuth.
- Bearer Token
- An access token that works for whoever presents the token, with no other proof of identity. Anyone who steals a bearer token can use the token until the token expires.
- Also called: Bearer Token Usage
- Defined in: RFC 6750
C
- CAPTCHA
- A challenge that tells human users apart from automated bots.
- Also called: Completely Automated Public Turing test to tell Computers and Humans Apart
- Claim
- A piece of information asserted about a subject, typically included in a JSON Web Token.
- Client Credentials Grant
- An OAuth 2.0 grant type in which a client uses its own credentials to obtain an access token for itself.
- Also called: Client Credentials
- Defined in: RFC 6749 Section 4.4
- Client Id
- The public identifier of an Application in OAuth 2.0.
- Client Id Metadata Document
- An OAuth 2.0 extension in which the client identifier is an HTTPS URL that hosts a JSON document describing the client's metadata. The authorization server retrieves the metadata from the URL instead of requiring a Dynamic Client Registration request.
- Abbreviation: CIMD
- Also called: CIMD Domain, CIMD Domains, Client Id Metadata Documents
- Defined in: IETF CIMD Draft
- Client Secret
- A secret known only to the application and the authorization server in OAuth 2.0.
- Connector
- A configuration that authenticates users against an external user store. A Connector can also migrate users to FusionAuth on login.
- Consent
- A user's permission for an application to access the user's data.
- Cross-Origin Resource Sharing
- A browser security mechanism that lets a web page request restricted resources from another domain when the server allows the request.
- Abbreviation: CORS
D
- Default Tenant
- The Tenant that FusionAuth creates during installation. You can't delete the Default Tenant, which hosts the FusionAuth Admin UI Application.
- Demonstrating Proof of Possession
- An OAuth 2.0 extension that ties access and refresh tokens to a key pair that the client holds. A stolen token doesn't work without the private key.
- Abbreviation: DPoP
- Also called: Demonstrating Proof-of-Possession
- Defined in: RFC 9449
- Discovery Endpoint
- An OpenID Connect endpoint that publishes the Identity Provider's configuration.
- Dynamic Client Registration
- A protocol that lets OAuth 2.0 clients register with an authorization server at runtime.
- Abbreviation: DCR
- Also called: OAuth 2.0 Dynamic Client Registration Protocol
- Defined in: RFC 7591
E
- Elasticsearch
- A search engine that FusionAuth can use instead of the database to search for users. FusionAuth also supports OpenSearch, a fork of Elasticsearch, with the same configuration.
- Email Template
- A template that FusionAuth renders to build an email, such as a password reset email.
- Entity
- A FusionAuth object that represents something other than a user, such as a server or an organization.
- Also called: Entities
- Entity Grant
- A relationship that grants a user or entity specific permissions on a target entity.
- Also called: Entity Grants
- Entity Type
- A category of Entity that defines the Permissions available to Entities of that type.
- Also called: Entity Types
- Event Log
- A log of events that FusionAuth records, such as email delivery errors and lambda debug output.
F
- Family
- A way to group users together for parental consent or other purposes.
- Federated Authentication
- Authentication in which a user logs in through an external Identity Provider.
- First-Party Application
- An application that the organization running FusionAuth builds and maintains.
- Also called: first-party
- Form Field
- A predefined or customizable input field used to collect and validate user data in custom registration forms.
- FusionAuth Cloud
- The managed hosting service for FusionAuth.
G
- Google reCAPTCHA
- A CAPTCHA system from Google that helps protect websites from spam and abuse.
- Also called: reCAPTCHA
- Group
- A logical collection of users, often used to assign roles across multiple applications.
- Also called: Groups
H
- HMAC
- A way to sign a message with a shared secret and a hash function, such as SHA-256. FusionAuth uses HMAC to sign JSON Web Tokens and webhooks.
- Also called: Hash-based Message Authentication Code
- Hosted Login Pages
- The login, registration, password recovery, and multi-factor authentication pages that FusionAuth serves. A Theme controls the look of the pages.
- Hybrid Flow
- An OpenID Connect flow that returns an authorization code together with an Id token, an access token, or both from the authorization endpoint. The client exchanges the code for tokens at the token endpoint.
- Also called: Hybrid Grant
- Defined in: OpenID Connect Core 1.0 Section 3.3
I
- Identity Provider
- An external system, such as Google or Microsoft Entra ID, that FusionAuth can use for authentication.
- Abbreviation: IdP
- Identity Provider Initiated Login
- A SAML workflow where login starts at the Identity Provider.
- Also called: IdP Initiated Login
- Id Token
- A JSON Web Token that contains information about the authenticated user.
- Implicit Grant
- An OAuth 2.0 grant type that returns an access token directly from the authorization endpoint. RFC 9700 recommends the Authorization Code grant with Proof Key for Code Exchange instead.
- Also called: Implicit Flow
- Defined in: RFC 6749 Section 4.2, RFC 9700 Section 2.1.2
- Introspection
- An OAuth 2.0 endpoint that reports whether a token is active.
- Also called: Token Introspection, OAuth 2.0 Token Introspection
- Defined in: RFC 7662
- Issuer
- The party that issued a JSON Web Token, stored in the iss claim.
- Issuer Identification
- A standard that adds an iss parameter to authorization responses to prevent mix-up attacks.
- Also called: OAuth 2.0 Authorization Server Issuer Identification
- Defined in: RFC 9207
J
- JSON Merge Patch
- A format for updating a JSON document by merging a partial document into the target.
- Defined in: RFC 7396
- JSON Patch
- A request format that lists edits to a JSON document, such as add, remove, and replace. The server applies the edits in order.
- Defined in: RFC 6902
- JSON Web Algorithms
- The specification that names the signing and encryption algorithms, such as RS256, for JSON Web Signatures, JSON Web Encryption, and JSON Web Keys.
- Abbreviation: JWA
- Defined in: RFC 7518
- JSON Web Encryption
- A specification for representing encrypted content as JSON data structures.
- Abbreviation: JWE
- Defined in: RFC 7516
- JSON Web Key
- A public or private cryptographic key written as a JSON object.
- Abbreviation: JWK
- Defined in: RFC 7517
- JSON Web Key Set
- A JSON object that contains a set of JSON Web Keys. FusionAuth publishes the public keys that verify JSON Web Tokens as a JSON Web Key Set.
- Abbreviation: JWKS
- Defined in: RFC 7517 Section 5
- JSON Web Key Thumbprint
- A hash of a JSON Web Key's required parameters that uniquely identifies the key.
- Also called: JWK Thumbprint
- Defined in: RFC 7638
- JSON Web Signature
- A specification for representing signed content as JSON data structures.
- Abbreviation: JWS
- Defined in: RFC 7515
- JSON Web Token
- A compact, signed token that carries claims between two parties. FusionAuth issues access tokens and Id tokens as JSON Web Tokens.
- Abbreviation: JWT
- Defined in: RFC 7519
- JSON Web Token Best Current Practices
- Security guidelines for implementing and using JSON Web Tokens.
- Abbreviation: JWT BCP
- Defined in: RFC 8725
K
- Kafka
- A message streaming platform that FusionAuth can send events to.
- Key
- A cryptographic key that FusionAuth uses to sign or encrypt data, such as JSON Web Tokens.
- Key Master
- The FusionAuth subsystem for managing cryptographic keys.
- Kickstart
- A file of API requests that FusionAuth runs on first startup to configure a new instance.
L
M
- Message Template
- A template that FusionAuth renders to build an SMS or other message.
- Messenger
- A configuration that FusionAuth uses to send messages, such as SMS, through a provider.
- Microsoft Entra ID
- Microsoft's identity service for organizations, formerly named Azure Active Directory (Azure AD). FusionAuth can use Entra ID as an Identity Provider.
- Abbreviation: AAD
- Also called: Azure AD, Entra ID
- Migration
- The process of moving users or data into, between, or out of FusionAuth.
- Multi-Factor Authentication
- An authentication method that requires two or more independent factors.
- Abbreviation: MFA
- Multi-Tenancy
- An architecture in which one instance serves multiple tenants with isolated data.
- Also called: multi-tenant
- Mutual-TLS for OAuth 2.0
- An OAuth 2.0 extension in which the client proves its identity with an X.509 certificate during the TLS handshake. Tokens issued to the client only work with that certificate.
- Abbreviation: mTLS
- Also called: Mutual TLS, Mutual-TLS Client Authentication
- Defined in: RFC 8705
O
- OAuth 2.0
- A framework that lets an application get scoped access to an API, for itself or for a user, without the user's password.
- Also called: OAuth, OAuth2, The OAuth 2.0 Authorization Framework
- Defined in: RFC 6749
- OAuth 2.0 for Native Apps
- An IETF Best Current Practice recommending external user agents over embedded webviews for secure native app authentication.
- Defined in: RFC 8252
- OAuth 2.0 Grant Type
- A method for an application to acquire an access token.
- OAuth 2.0 Security Best Current Practice
- IETF security requirements and attack mitigations for OAuth 2.0 implementations.
- Also called: OAuth Security BCP
- Defined in: RFC 9700
- OpenID Connect
- A protocol built on OAuth 2.0 that adds login. OpenID Connect gives the application an Id token that describes the user.
- Abbreviation: OIDC
- Defined in: OpenID Connect Core 1.0
- OpenSearch
- An open-source fork of Elasticsearch that FusionAuth supports as a search engine. FusionAuth configures OpenSearch with the same settings as Elasticsearch.
P
- Password-Based Key Derivation Function 2
- A key derivation function that FusionAuth supports for password hashing.
- Abbreviation: PBKDF2
- Password Grant
- An OAuth 2.0 grant type in which the user gives a username and password directly to the application. RFC 9700 forbids this grant.
- Also called: Resource Owner Password Credentials, Resource Owner Password Credentials Grant, ROPC
- Defined in: RFC 6749 Section 4.3, RFC 9700 Section 2.4
- Password Hash
- A cryptographic hash of a user's password.
- Password Validation
- The check that a password meets the password rules of the Tenant.
- Permission
- A named action that an Entity Type defines. An Entity Grant assigns Permissions on a target Entity to a User or Entity.
- Also called: Permissions
- Proof Key for Code Exchange
- An extension to OAuth 2.0 that mitigates authorization code interception attacks using dynamic code verifiers and challenges.
- Abbreviation: PKCE
- Defined in: RFC 7636
- Proxy
- A server that forwards requests to FusionAuth. A proxy can handle Transport Layer Security termination or load balancing.
R
- Reactor
- The FusionAuth system that manages licenses and paid features.
- Recovery Code
- A code used to regain access to an account when the user loses their multi-factor authentication factors.
- Refresh Token
- A credential that an application exchanges for a new access token without asking the user to log in again.
- Registration
- The association between a User and an Application.
- Resource Indicators
- An OAuth 2.0 extension that lets a client name the resource server an access token is for.
- Also called: Resource Indicators for OAuth 2.0
- Defined in: RFC 8707
- Revocation
- The process of invalidating a token before its expiration.
- Also called: Token Revocation, OAuth 2.0 Token Revocation
- Defined in: RFC 7009
- Rivest-Shamir-Adleman
- A public-key cryptosystem. FusionAuth can sign JSON Web Tokens with RSA keys.
- Abbreviation: RSA
- Role
- A named label that an Application defines and that FusionAuth assigns to a User through a Registration or Group. Your application interprets the Role when authorizing access.
- Also called: Roles
- RS256
- An asymmetric signature algorithm that uses the Rivest-Shamir-Adleman algorithm with the Secure Hash Algorithm 256-bit hash function.
- Defined in: RFC 7518 Section 3.3
S
- Scope
- A string that limits the access that an OAuth 2.0 access token grants.
- Also called: OAuth Scopes, OAuth 2.0 Scopes
- Search Engine
- The system that FusionAuth uses to search for users: the database or Elasticsearch.
- Security Assertion Markup Language
- An XML-based open standard for exchanging authentication and authorization data between an Identity Provider and a Service Provider.
- Abbreviation: SAML
- Defined in: SAML 2.0
- Self-Service Registration
- A feature that lets users create their own accounts.
- Also called: self-service
- Service Provider
- The application that provides a service and relies on an Identity Provider for authentication in SAML.
- Abbreviation: SP
- Service Provider Initiated Login
- A SAML workflow where login starts at the Service Provider.
- Also called: SP Initiated Login
- SHA-256
- A cryptographic hash function that many signing and password hashing algorithms use.
- Single Sign-On
- A session that lets a user log in once and then use multiple applications without logging in again.
- Abbreviation: SSO
- Step-Up Authentication
- A request for an additional authentication factor before a user performs a sensitive action.
- Super Role
- A flag on an Application Role that marks the Role as encompassing all other Roles in that Application. The flag does not grant Admin UI access.
- System for Cross-domain Identity Management
- An open standard defining an HTTP REST protocol and schema for automating user and group provisioning across systems.
- Abbreviation: SCIM
- Also called: SCIM 2.0
- Defined in: RFC 7642, RFC 7643, RFC 7644
- System Log
- The log files that FusionAuth writes. The System Log helps you troubleshoot an instance.
T
- Tenant
- A logical container for Users, Applications, and settings that is isolated from other Tenants.
- Terraform
- An infrastructure as code tool. The FusionAuth Terraform provider manages FusionAuth configuration, such as Tenants and Applications, in version-controlled files.
- Also called: FusionAuth Terraform Provider
- Theme
- A set of templates and assets that controls the look of the hosted login pages.
- Third-Party Application
- An application that an organization other than the one running FusionAuth builds and maintains.
- Also called: third-party
- Time-Based One-Time Password
- An algorithm that computes a time-synchronized one-time password from a shared secret key and current timestamp.
- Abbreviation: TOTP
- Defined in: RFC 6238
- Token
- A general term for an access token, Id token, or refresh token.
- Token Exchange
- An OAuth 2.0 grant type enabling security token exchange, delegation, and impersonation across services.
- Also called: OAuth 2.0 Token Exchange, Token Exchange Grant
- Defined in: RFC 8693
- Total Users
- The total number of users in a FusionAuth instance.
- Trust Token
- A short-lived token that proves a user completed multi-factor authentication. Some API requests, such as changing a password when multi-factor authentication is enabled, require the token.
- Two-Factor Authentication
- An authentication method that verifies identity with exactly two independent factors.
- Abbreviation: 2FA
- Also called: two-factor
U
- Universally Unique Identifier
- A 128-bit value used to identify objects without central coordination. The standard string format uses groups of 8-4-4-4-12 hexadecimal digits.
- Abbreviation: UUID
- Also called: GUID
- Defined in: RFC 9562
- User
- A person or account that can log in to Applications.
- User Action
- An action that an administrator or application takes on a user, such as locking the account.
- User Data
- Custom data stored in the data field of a User.
- UserInfo Endpoint
- An OpenID Connect endpoint that returns claims about the authenticated user.
- User Search
- Searching for users by attributes such as email address, name, or custom data.
- User Verification
- Confirming that a user controls an email address or phone number.
V
- Verification Code
- A code that FusionAuth sends to a user to verify an email address or phone number.
W
- WebAuthn
- A World Wide Web Consortium standard for passwordless authentication using public-key credentials.
- Also called: Web Authentication
- Defined in: W3C WebAuthn
- Webhook
- An HTTP callback that FusionAuth calls when an event occurs.
- Webhook Event
- An event that triggers a webhook, such as user.create.
- White Labeling
- The process of rebranding FusionAuth to match your own brand.
- Also called: private-labeled, private labeling