Skip to main content

Overview

Blueprint utilizes four primary methods of authentication:

  1. Email & Password: Uses access and refresh tokens for session management.
  2. Kraken OAuth: Delegates authentication to the Kraken Auth Server using OAuth 2.0 PKCE. This is the recommended replacement for email & password.
  3. Masquerade: Simulates a user's session using their User ID and a masquerade token.
  4. Expiring URL: Grants limited access for specific actions.
Deprecation notice

Email & Password authentication through the ObtainKrakenToken mutation is deprecated and will be removed in the near future. We'll be replacing it with the Kraken Auth Server soon.

How is authentication handled in Blueprint?​

Authentication in Blueprint is managed by a shared internal auth module, which provides:

  • Middleware
  • API routes
  • react-query hooks
  • Custom GraphQL handler
  • Browser cookies

This combination ensures a robust, scalable, and secure authentication solution.

For detailed implementation guidance, see the setup guides for the App Router or the Pages Router, and the API reference.

This section explains how Blueprint implements each authentication method. These methods are crucial for a secure authentication solution.

Which API routes are used for authentication?​

There are 3 API routes used for authentication purposes:

For implementation details, see the API reference.

How does Blueprint use Kraken for authentication?​

Blueprint uses the obtainKrakenToken mutation to request authorisation tokens from Kraken. Your Kraken instance's API documentation (e.g. Kraken GB GraphQL reference) details the different errors this can raise.