# Glossary

Learn the meaning of the terms used across the FusionAuth documentation.

> For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt)

## A

[Access Token](https://fusionauth.io/docs/authentication/oauth/tokens.md#access-token)

A credential that an application sends to an API to show that the request is authorized.

[Admin UI](https://fusionauth.io/docs/get-started/first-time-setup.md)

The web interface for administering FusionAuth.

Also called: FusionAuth Admin UI

[Advanced Registration Forms](https://fusionauth.io/docs/users/register/advanced-registration-forms.md)

Forms that let you build multi-step registration and admin user management flows for your applications.

[API Key](https://fusionauth.io/docs/apis/authentication.md#api-key-authentication)

A credential used to authenticate administrative requests to the FusionAuth API.

[Application](https://fusionauth.io/docs/concepts/types/applications.md)

A software program that your users log in to through FusionAuth.

[Audit Log](https://fusionauth.io/docs/apis/audit-logs.md)

A record of administrative actions taken within FusionAuth.

[Authorization Code Grant](https://fusionauth.io/docs/authentication/oauth.md)

An OAuth 2.0 grant type in which a client exchanges an authorization code for tokens.

Also called: Authorization Code Flow, Auth Code Flow

Defined in: [RFC 6749 Section 4.1](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1)

## B

[Basic Authentication](https://datatracker.ietf.org/doc/html/rfc7617)

An HTTP authentication protocol transmitting credentials as base64-encoded username and password pairs.

Also called: Basic Auth, HTTP Basic Authentication

Defined in: [RFC 7617](https://datatracker.ietf.org/doc/html/rfc7617)

[Bcrypt](https://fusionauth.io/docs/migrate/password-hashes/algorithms.md)

A password hashing algorithm supported by FusionAuth.

[Bearer Token](https://datatracker.ietf.org/doc/html/rfc6750)

An access token that works for whoever presents the token, with no other proof of identity. Anyone who steals a bearer token can use the token until the token expires.

Also called: Bearer Token Usage

Defined in: [RFC 6750](https://datatracker.ietf.org/doc/html/rfc6750)

## C

[CAPTCHA](https://fusionauth.io/docs/security/account-protection/advanced-threat-detection.md)

A challenge that tells human users apart from automated bots.

Also called: Completely Automated Public Turing test to tell Computers and Humans Apart

[Claim](https://fusionauth.io/docs/authentication/oauth/tokens.md#access-token-claims)

A piece of information asserted about a subject, typically included in a JSON Web Token.

[Client Credentials Grant](https://fusionauth.io/docs/authentication/oauth.md)

An OAuth 2.0 grant type in which a client uses its own credentials to obtain an access token for itself.

Also called: Client Credentials

Defined in: [RFC 6749 Section 4.4](https://datatracker.ietf.org/doc/html/rfc6749#section-4.4)

[Client Id](https://fusionauth.io/docs/concepts/types/applications.md)

The public identifier of an Application in OAuth 2.0.

[Client Id Metadata Document](https://fusionauth.io/docs/concepts/types/cimd-domains.md)

An OAuth 2.0 extension in which the client identifier is an HTTPS URL that hosts a JSON document describing the client's metadata. The authorization server retrieves the metadata from the URL instead of requiring a Dynamic Client Registration request.

Abbreviation: CIMD

Also called: CIMD Domain, CIMD Domains, Client Id Metadata Documents

Defined in: [IETF CIMD Draft](https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/)

[Client Secret](https://fusionauth.io/docs/concepts/types/applications.md)

A secret known only to the application and the authorization server in OAuth 2.0.

[Connector](https://fusionauth.io/docs/users/provision/connectors.md)

A configuration that authenticates users against an external user store. A Connector can also migrate users to FusionAuth on login.

[Consent](https://fusionauth.io/docs/apis/consents.md)

A user's permission for an application to access the user's data.

[Cross-Origin Resource Sharing](https://fusionauth.io/docs/security/clients/cors.md)

A browser security mechanism that lets a web page request restricted resources from another domain when the server allows the request.

Abbreviation: CORS

## D

[Default Tenant](https://fusionauth.io/docs/concepts/plans-and-limits/limitations.md#default-configuration)

The Tenant that FusionAuth creates during installation. You can't delete the Default Tenant, which hosts the FusionAuth Admin UI Application.

[Demonstrating Proof of Possession](https://fusionauth.io/docs/authentication/oauth/dpop.md)

An OAuth 2.0 extension that ties access and refresh tokens to a key pair that the client holds. A stolen token doesn't work without the private key.

Abbreviation: DPoP

Also called: Demonstrating Proof-of-Possession

Defined in: [RFC 9449](https://datatracker.ietf.org/doc/html/rfc9449)

[Device Authorization Grant](https://fusionauth.io/docs/apis/oauth/device.md)

An OAuth 2.0 grant type for devices with limited input, such as TVs. The user completes the login on a second device.

Also called: Device Code, Device Flow, Device Code Grant, Device Grant

Defined in: [RFC 8628](https://datatracker.ietf.org/doc/html/rfc8628)

[Discovery Endpoint](https://fusionauth.io/docs/apis/oauth/openid-configuration.md)

An OpenID Connect endpoint that publishes the Identity Provider's configuration.

[Dynamic Client Registration](https://datatracker.ietf.org/doc/html/rfc7591)

A protocol that lets OAuth 2.0 clients register with an authorization server at runtime.

Abbreviation: DCR

Also called: OAuth 2.0 Dynamic Client Registration Protocol

Defined in: [RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591)

## E

[Elasticsearch](https://fusionauth.io/docs/users/search/switch-search-engines.md)

A search engine that FusionAuth can use instead of the database to search for users. FusionAuth also supports OpenSearch, a fork of Elasticsearch, with the same configuration.

[Email Template](https://fusionauth.io/docs/email/email-templates.md)

A template that FusionAuth renders to build an email, such as a password reset email.

[Entity](https://fusionauth.io/docs/concepts/types/entity-management.md)

A FusionAuth object that represents something other than a user, such as a server or an organization.

Also called: Entities

[Entity Grant](https://fusionauth.io/docs/concepts/types/entity-management.md)

A relationship that grants a user or entity specific permissions on a target entity.

Also called: Entity Grants

[Entity Type](https://fusionauth.io/docs/concepts/types/entity-management.md#entity-types)

A category of Entity that defines the Permissions available to Entities of that type.

Also called: Entity Types

[Event Log](https://fusionauth.io/docs/deploy/troubleshoot/troubleshooting.md#event-log)

A log of events that FusionAuth records, such as email delivery errors and lambda debug output.

## F

[Family](https://fusionauth.io/docs/apis/families.md)

A way to group users together for parental consent or other purposes.

[Federated Authentication](https://fusionauth.io/docs/authentication/identity-providers.md)

Authentication in which a user logs in through an external Identity Provider.

[Fine-Grained Authorization](https://fusionauth.io/docs/authorization/fine-grained-authorization.md)

Authorization that controls which actions a user or service can perform on a specific resource, such as a file.

[First-Party Application](https://fusionauth.io/docs/concepts/types/applications.md)

An application that the organization running FusionAuth builds and maintains.

Also called: first-party

[Form Field](https://fusionauth.io/docs/users/register/advanced-registration-forms.md#create-form-fields)

A predefined or customizable input field used to collect and validate user data in custom registration forms.

[FusionAuth Cloud](https://fusionauth.io/docs/cloud.md)

The managed hosting service for FusionAuth.

## G

[Google reCAPTCHA](https://fusionauth.io/docs/security/account-protection/advanced-threat-detection.md)

A CAPTCHA system from Google that helps protect websites from spam and abuse.

Also called: reCAPTCHA

[Group](https://fusionauth.io/docs/concepts/types/groups.md)

A logical collection of users, often used to assign roles across multiple applications.

Also called: Groups

## H

[HMAC](https://fusionauth.io/docs/security/tokens-and-keys/key-master.md)

A way to sign a message with a shared secret and a hash function, such as SHA-256. FusionAuth uses HMAC to sign JSON Web Tokens and webhooks.

Also called: Hash-based Message Authentication Code

[Hosted Login Pages](https://fusionauth.io/docs/concepts/integration-points.md#hosted-login-pages)

The login, registration, password recovery, and multi-factor authentication pages that FusionAuth serves. A Theme controls the look of the pages.

[Hybrid Flow](https://openid.net/specs/openid-connect-core-1_0.html#HybridFlowAuth)

An OpenID Connect flow that returns an authorization code together with an Id token, an access token, or both from the authorization endpoint. The client exchanges the code for tokens at the token endpoint.

Also called: Hybrid Grant

Defined in: [OpenID Connect Core 1.0 Section 3.3](https://openid.net/specs/openid-connect-core-1_0.html#HybridFlowAuth)

## I

[Identity Provider](https://fusionauth.io/docs/authentication/identity-providers.md)

An external system, such as Google or Microsoft Entra ID, that FusionAuth can use for authentication.

Abbreviation: IdP

[Identity Provider Initiated Login](https://fusionauth.io/docs/authentication/identity-providers/enterprise/samlv2-idp-initiated.md)

A SAML workflow where login starts at the Identity Provider.

Also called: IdP Initiated Login

[Id Token](https://fusionauth.io/docs/authentication/oauth/tokens.md#id-token)

A JSON Web Token that contains information about the authenticated user.

[Implicit Grant](https://fusionauth.io/docs/authentication/oauth.md)

An OAuth 2.0 grant type that returns an access token directly from the authorization endpoint. RFC 9700 recommends the Authorization Code grant with Proof Key for Code Exchange instead.

Also called: Implicit Flow

Defined in: [RFC 6749 Section 4.2](https://datatracker.ietf.org/doc/html/rfc6749#section-4.2), [RFC 9700 Section 2.1.2](https://datatracker.ietf.org/doc/html/rfc9700#section-2.1.2)

[Introspection](https://fusionauth.io/docs/apis/oauth/introspect.md)

An OAuth 2.0 endpoint that reports whether a token is active.

Also called: Token Introspection, OAuth 2.0 Token Introspection

Defined in: [RFC 7662](https://datatracker.ietf.org/doc/html/rfc7662)

[Issuer](https://fusionauth.io/docs/authentication/oauth/tokens.md#access-token-claims)

The party that issued a JSON Web Token, stored in the iss claim.

[Issuer Identification](https://fusionauth.io/docs/authentication/oauth/issuer-validation.md)

A standard that adds an iss parameter to authorization responses to prevent mix-up attacks.

Also called: OAuth 2.0 Authorization Server Issuer Identification

Defined in: [RFC 9207](https://datatracker.ietf.org/doc/html/rfc9207)

## J

[JSON Merge Patch](https://datatracker.ietf.org/doc/html/rfc7396)

A format for updating a JSON document by merging a partial document into the target.

Defined in: [RFC 7396](https://datatracker.ietf.org/doc/html/rfc7396)

[JSON Patch](https://datatracker.ietf.org/doc/html/rfc6902)

A request format that lists edits to a JSON document, such as add, remove, and replace. The server applies the edits in order.

Defined in: [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902)

[JSON Web Algorithms](https://datatracker.ietf.org/doc/html/rfc7518)

The specification that names the signing and encryption algorithms, such as RS256, for JSON Web Signatures, JSON Web Encryption, and JSON Web Keys.

Abbreviation: JWA

Defined in: [RFC 7518](https://datatracker.ietf.org/doc/html/rfc7518)

[JSON Web Encryption](https://datatracker.ietf.org/doc/html/rfc7516)

A specification for representing encrypted content as JSON data structures.

Abbreviation: JWE

Defined in: [RFC 7516](https://datatracker.ietf.org/doc/html/rfc7516)

[JSON Web Key](https://fusionauth.io/docs/apis/oauth/jwks.md)

A public or private cryptographic key written as a JSON object.

Abbreviation: JWK

Defined in: [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517)

[JSON Web Key Set](https://fusionauth.io/docs/apis/oauth/jwks.md)

A JSON object that contains a set of JSON Web Keys. FusionAuth publishes the public keys that verify JSON Web Tokens as a JSON Web Key Set.

Abbreviation: JWKS

Defined in: [RFC 7517 Section 5](https://datatracker.ietf.org/doc/html/rfc7517#section-5)

[JSON Web Key Thumbprint](https://datatracker.ietf.org/doc/html/rfc7638)

A hash of a JSON Web Key's required parameters that uniquely identifies the key.

Also called: JWK Thumbprint

Defined in: [RFC 7638](https://datatracker.ietf.org/doc/html/rfc7638)

[JSON Web Signature](https://datatracker.ietf.org/doc/html/rfc7515)

A specification for representing signed content as JSON data structures.

Abbreviation: JWS

Defined in: [RFC 7515](https://datatracker.ietf.org/doc/html/rfc7515)

[JSON Web Token](https://fusionauth.io/docs/authentication/login-api/json-web-tokens.md)

A compact, signed token that carries claims between two parties. FusionAuth issues access tokens and Id tokens as JSON Web Tokens.

Abbreviation: JWT

Defined in: [RFC 7519](https://datatracker.ietf.org/doc/html/rfc7519)

[JSON Web Token Best Current Practices](https://datatracker.ietf.org/doc/html/rfc8725)

Security guidelines for implementing and using JSON Web Tokens.

Abbreviation: JWT BCP

Defined in: [RFC 8725](https://datatracker.ietf.org/doc/html/rfc8725)

## K

[Kafka](https://fusionauth.io/docs/events/kafka.md)

A message streaming platform that FusionAuth can send events to.

[Key](https://fusionauth.io/docs/security/tokens-and-keys/key-master.md)

A cryptographic key that FusionAuth uses to sign or encrypt data, such as JSON Web Tokens.

[Key Master](https://fusionauth.io/docs/security/tokens-and-keys/key-master.md)

The FusionAuth subsystem for managing cryptographic keys.

[Kickstart](https://fusionauth.io/docs/get-started/develop/kickstart.md)

A file of API requests that FusionAuth runs on first startup to configure a new instance.

## L

[Lambda](https://fusionauth.io/docs/lambdas.md)

A JavaScript function that FusionAuth runs at a defined point, such as adding claims to a JSON Web Token during login.

[Locale](https://fusionauth.io/docs/apis/data-types.md#locales)

A setting that defines the language and region for a user.

[Login API](https://fusionauth.io/docs/concepts/integration-points.md#login-api)

The FusionAuth API that logs a user in without the hosted login pages.

## M

[Message Template](https://fusionauth.io/docs/messengers/message-templates.md)

A template that FusionAuth renders to build an SMS or other message.

[Messenger](https://fusionauth.io/docs/messengers.md)

A configuration that FusionAuth uses to send messages, such as SMS, through a provider.

[Microsoft Entra ID](https://fusionauth.io/docs/authentication/identity-providers/enterprise/azure-ad-oidc.md)

Microsoft's identity service for organizations, formerly named Azure Active Directory (Azure AD). FusionAuth can use Entra ID as an Identity Provider.

Abbreviation: AAD

Also called: Azure AD, Entra ID

[Migration](https://fusionauth.io/docs/migrate.md)

The process of moving users or data into, between, or out of FusionAuth.

[Multi-Factor Authentication](https://fusionauth.io/docs/authentication/multi-factor-authentication.md)

An authentication method that requires two or more independent factors.

Abbreviation: MFA

[Multi-Tenancy](https://fusionauth.io/docs/concepts/types/tenants.md)

An architecture in which one instance serves multiple tenants with isolated data.

Also called: multi-tenant

[Mutual-TLS for OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc8705)

An OAuth 2.0 extension in which the client proves its identity with an X.509 certificate during the TLS handshake. Tokens issued to the client only work with that certificate.

Abbreviation: mTLS

Also called: Mutual TLS, Mutual-TLS Client Authentication

Defined in: [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705)

## O

[OAuth 2.0](https://fusionauth.io/docs/authentication/oauth.md)

A framework that lets an application get scoped access to an API, for itself or for a user, without the user's password.

Also called: OAuth, OAuth2, The OAuth 2.0 Authorization Framework

Defined in: [RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749)

[OAuth 2.0 for Native Apps](https://datatracker.ietf.org/doc/html/rfc8252)

An IETF Best Current Practice recommending external user agents over embedded webviews for secure native app authentication.

Defined in: [RFC 8252](https://datatracker.ietf.org/doc/html/rfc8252)

[OAuth 2.0 Grant Type](https://fusionauth.io/docs/authentication/oauth.md)

A method for an application to acquire an access token.

[OAuth 2.0 Security Best Current Practice](https://datatracker.ietf.org/doc/html/rfc9700)

IETF security requirements and attack mitigations for OAuth 2.0 implementations.

Also called: OAuth Security BCP

Defined in: [RFC 9700](https://datatracker.ietf.org/doc/html/rfc9700)

[One-Time Password](https://fusionauth.io/docs/authentication/multi-factor-authentication.md)

A password or code that works for a single login or transaction.

Abbreviation: OTP

[OpenID Connect](https://fusionauth.io/docs/authentication/identity-providers/overview-oidc.md)

A protocol built on OAuth 2.0 that adds login. OpenID Connect gives the application an Id token that describes the user.

Abbreviation: OIDC

Defined in: [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html)

[OpenSearch](https://fusionauth.io/docs/deploy/production/install/search.md)

An open-source fork of Elasticsearch that FusionAuth supports as a search engine. FusionAuth configures OpenSearch with the same settings as Elasticsearch.

## P

[Password-Based Key Derivation Function 2](https://fusionauth.io/docs/migrate/password-hashes/algorithms.md)

A key derivation function that FusionAuth supports for password hashing.

Abbreviation: PBKDF2

[Password Grant](https://fusionauth.io/docs/authentication/oauth.md)

An OAuth 2.0 grant type in which the user gives a username and password directly to the application. RFC 9700 forbids this grant.

Also called: Resource Owner Password Credentials, Resource Owner Password Credentials Grant, ROPC

Defined in: [RFC 6749 Section 4.3](https://datatracker.ietf.org/doc/html/rfc6749#section-4.3), [RFC 9700 Section 2.4](https://datatracker.ietf.org/doc/html/rfc9700#section-2.4)

[Password Hash](https://fusionauth.io/docs/migrate/password-hashes/algorithms.md)

A cryptographic hash of a user's password.

[Password Validation](https://fusionauth.io/docs/theme/advanced-themes/client-side-password-rule-validation.md)

The check that a password meets the password rules of the Tenant.

[Permission](https://fusionauth.io/docs/concepts/types/entity-management.md#permissions)

A named action that an Entity Type defines. An Entity Grant assigns Permissions on a target Entity to a User or Entity.

Also called: Permissions

[Proof Key for Code Exchange](https://fusionauth.io/docs/authentication/oauth.md)

An extension to OAuth 2.0 that mitigates authorization code interception attacks using dynamic code verifiers and challenges.

Abbreviation: PKCE

Defined in: [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636)

[Proxy](https://fusionauth.io/docs/deploy/production/proxy-setup.md)

A server that forwards requests to FusionAuth. A proxy can handle Transport Layer Security termination or load balancing.

## R

[Reactor](https://fusionauth.io/docs/concepts/plans-and-limits/licensing.md)

The FusionAuth system that manages licenses and paid features.

[Recovery Code](https://fusionauth.io/docs/authentication/multi-factor-authentication.md#recovery-codes)

A code used to regain access to an account when the user loses their multi-factor authentication factors.

[Refresh Token](https://fusionauth.io/docs/authentication/oauth/tokens.md#refresh-token)

A credential that an application exchanges for a new access token without asking the user to log in again.

[Registration](https://fusionauth.io/docs/concepts/types/registrations.md)

The association between a User and an Application.

[Resource Indicators](https://fusionauth.io/docs/apis/oauth.md)

An OAuth 2.0 extension that lets a client name the resource server an access token is for.

Also called: Resource Indicators for OAuth 2.0

Defined in: [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707)

[Revocation](https://datatracker.ietf.org/doc/html/rfc7009)

The process of invalidating a token before its expiration.

Also called: Token Revocation, OAuth 2.0 Token Revocation

Defined in: [RFC 7009](https://datatracker.ietf.org/doc/html/rfc7009)

[Rich Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9396)

An OAuth 2.0 extension that carries fine-grained authorization details as structured JSON objects.

Abbreviation: RAR

Defined in: [RFC 9396](https://datatracker.ietf.org/doc/html/rfc9396)

[Rivest-Shamir-Adleman](https://fusionauth.io/docs/security/tokens-and-keys/key-master.md)

A public-key cryptosystem. FusionAuth can sign JSON Web Tokens with RSA keys.

Abbreviation: RSA

[Role](https://fusionauth.io/docs/concepts/types/roles.md)

A named label that an Application defines and that FusionAuth assigns to a User through a Registration or Group. Your application interprets the Role when authorizing access.

Also called: Roles

[RS256](https://datatracker.ietf.org/doc/html/rfc7518)

An asymmetric signature algorithm that uses the Rivest-Shamir-Adleman algorithm with the Secure Hash Algorithm 256-bit hash function.

Defined in: [RFC 7518 Section 3.3](https://datatracker.ietf.org/doc/html/rfc7518#section-3.3)

## S

[Scope](https://fusionauth.io/docs/concepts/scopes.md)

A string that limits the access that an OAuth 2.0 access token grants.

Also called: OAuth Scopes, OAuth 2.0 Scopes

[Search Engine](https://fusionauth.io/docs/users/search/switch-search-engines.md)

The system that FusionAuth uses to search for users: the database or Elasticsearch.

[Security Assertion Markup Language](https://fusionauth.io/docs/authentication/act-as-an-idp/host-saml-idp.md)

An XML-based open standard for exchanging authentication and authorization data between an Identity Provider and a Service Provider.

Abbreviation: SAML

Defined in: [SAML 2.0](https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf)

[Self-Service Registration](https://fusionauth.io/docs/concepts/types/registrations.md#registrations-and-self-service-registration)

A feature that lets users create their own accounts.

Also called: self-service

[Service Provider](https://fusionauth.io/docs/authentication/act-as-an-idp/host-saml-idp.md)

The application that provides a service and relies on an Identity Provider for authentication in SAML.

Abbreviation: SP

[Service Provider Initiated Login](https://fusionauth.io/docs/authentication/identity-providers/overview-samlv2.md)

A SAML workflow where login starts at the Service Provider.

Also called: SP Initiated Login

[SHA-256](https://fusionauth.io/docs/migrate/password-hashes/algorithms.md)

A cryptographic hash function that many signing and password hashing algorithms use.

[Single Sign-On](https://fusionauth.io/docs/authentication/sessions/single-sign-on.md)

A session that lets a user log in once and then use multiple applications without logging in again.

Abbreviation: SSO

[Step-Up Authentication](https://fusionauth.io/docs/authentication/multi-factor-authentication.md#step-up-auth)

A request for an additional authentication factor before a user performs a sensitive action.

[Super Role](https://fusionauth.io/docs/concepts/types/roles.md)

A flag on an Application Role that marks the Role as encompassing all other Roles in that Application. The flag does not grant Admin UI access.

[System for Cross-domain Identity Management](https://fusionauth.io/docs/users/provision/scim.md)

An open standard defining an HTTP REST protocol and schema for automating user and group provisioning across systems.

Abbreviation: SCIM

Also called: SCIM 2.0

Defined in: [RFC 7642](https://datatracker.ietf.org/doc/html/rfc7642), [RFC 7643](https://datatracker.ietf.org/doc/html/rfc7643), [RFC 7644](https://datatracker.ietf.org/doc/html/rfc7644)

[System Log](https://fusionauth.io/docs/deploy/troubleshoot/troubleshooting.md#system-log-ui)

The log files that FusionAuth writes. The System Log helps you troubleshoot an instance.

## T

[Tenant](https://fusionauth.io/docs/concepts/types/tenants.md)

A logical container for Users, Applications, and settings that is isolated from other Tenants.

[Terraform](https://fusionauth.io/docs/deploy/production/terraform.md)

An infrastructure as code tool. The FusionAuth Terraform provider manages FusionAuth configuration, such as Tenants and Applications, in version-controlled files.

Also called: FusionAuth Terraform Provider

[Theme](https://fusionauth.io/docs/theme.md)

A set of templates and assets that controls the look of the hosted login pages.

[Third-Party Application](https://fusionauth.io/docs/authentication/identity-providers.md)

An application that an organization other than the one running FusionAuth builds and maintains.

Also called: third-party

[Time-Based One-Time Password](https://fusionauth.io/docs/authentication/multi-factor-authentication.md)

An algorithm that computes a time-synchronized one-time password from a shared secret key and current timestamp.

Abbreviation: TOTP

Defined in: [RFC 6238](https://datatracker.ietf.org/doc/html/rfc6238)

[Token](https://fusionauth.io/docs/authentication/oauth/tokens.md)

A general term for an access token, Id token, or refresh token.

[Token Exchange](https://fusionauth.io/docs/authorization/token-exchange.md)

An OAuth 2.0 grant type enabling security token exchange, delegation, and impersonation across services.

Also called: OAuth 2.0 Token Exchange, Token Exchange Grant

Defined in: [RFC 8693](https://datatracker.ietf.org/doc/html/rfc8693)

[Total Users](https://fusionauth.io/docs/apis/reports/retrieve-totals-report.md)

The total number of users in a FusionAuth instance.

[Trust Token](https://fusionauth.io/docs/authentication/multi-factor-authentication.md#trust-tokens-and-trust-challenges)

A short-lived token that proves a user completed multi-factor authentication. Some API requests, such as changing a password when multi-factor authentication is enabled, require the token.

[Two-Factor Authentication](https://fusionauth.io/docs/authentication/multi-factor-authentication.md)

An authentication method that verifies identity with exactly two independent factors.

Abbreviation: 2FA

Also called: two-factor

## U

[Universally Unique Identifier](https://fusionauth.io/docs/apis/data-types.md#uuids)

A 128-bit value used to identify objects without central coordination. The standard string format uses groups of 8-4-4-4-12 hexadecimal digits.

Abbreviation: UUID

Also called: GUID

Defined in: [RFC 9562](https://datatracker.ietf.org/doc/html/rfc9562)

[User](https://fusionauth.io/docs/concepts/types/users.md)

A person or account that can log in to Applications.

[User Action](https://fusionauth.io/docs/users/user-actions.md)

An action that an administrator or application takes on a user, such as locking the account.

[User Data](https://fusionauth.io/docs/concepts/types/users.md#user-data)

Custom data stored in the data field of a User.

[UserInfo Endpoint](https://fusionauth.io/docs/apis/oauth/userinfo.md)

An OpenID Connect endpoint that returns claims about the authenticated user.

[User Search](https://fusionauth.io/docs/users/search.md)

Searching for users by attributes such as email address, name, or custom data.

[User Verification](https://fusionauth.io/docs/users/verify/registration-email-verification.md)

Confirming that a user controls an email address or phone number.

## V

[Verification Code](https://fusionauth.io/docs/users/verify/registration-email-verification.md)

A code that FusionAuth sends to a user to verify an email address or phone number.

## W

[WebAuthn](https://fusionauth.io/docs/authentication/passkeys.md)

A World Wide Web Consortium standard for passwordless authentication using public-key credentials.

Also called: Web Authentication

Defined in: [W3C WebAuthn](https://www.w3.org/TR/webauthn-2/)

[Webhook](https://fusionauth.io/docs/events.md)

An HTTP callback that FusionAuth calls when an event occurs.

[Webhook Event](https://fusionauth.io/docs/events/reference.md)

An event that triggers a webhook, such as user.create.

[White Labeling](https://fusionauth.io/docs/theme.md)

The process of rebranding FusionAuth to match your own brand.

Also called: private-labeled, private labeling

## X

[X.509](https://fusionauth.io/docs/security/tokens-and-keys/key-master.md)

A standard format for public key certificates.

Also called: X.509 Certificate

Defined in: [RFC 5280](https://datatracker.ietf.org/doc/html/rfc5280)
---

## Other pages in Concepts

> For the full index of this section, see [Concepts](https://fusionauth.io/docs/llms-concepts.txt).

- [Authentication and Authorization](https://fusionauth.io/docs/concepts/authentication-authorization.md): Learn about the difference between authentication and authorization in FusionAuth.
- [Identity Providers](https://fusionauth.io/docs/concepts/identity-providers.md): Learn how FusionAuth delegates login to external identity providers.
- [Integration Points](https://fusionauth.io/docs/concepts/integration-points.md): Learn about how FusionAuth integrates with existing or new applications.
- [Localization and Internationalization](https://fusionauth.io/docs/concepts/localization-and-internationalization.md): Learn about localization, translations and internationalization in FusionAuth.
- [Patterns](https://fusionauth.io/docs/concepts/patterns.md): Learn about the common ways teams use FusionAuth, and find the pattern that fits your architecture.
- [Plans and Limits](https://fusionauth.io/docs/concepts/plans-and-limits.md): Learn which features each FusionAuth plan includes, how licensing works, and the limits that apply to every instance.
- [OAuth Scopes](https://fusionauth.io/docs/concepts/scopes.md): Learn about the OAuth scopes FusionAuth supports and how applications request them.
- [Core Types](https://fusionauth.io/docs/concepts/types.md): Learn about the core types in FusionAuth and how they interact to manage authentication and authorization.