---
id: "customers/authentication"
title: "Authentication"
description: "Authentication is a RevenueCat feature that verifies the identity of each Customer. Use it to connect your identity provider to RevenueCat, and to secure the requests between the RevenueCat SDK and RevenueCat. Authentication is in private beta and is not broadly available yet. Most apps continue to identify Customers with App User IDs."
permalink: "/docs/customers/customer-authentication"
slug: "customer-authentication"
version: "current"
original_source: "docs/customers/authentication.mdx"
---

> **AI agents:** This is the Markdown version of a RevenueCat documentation page. For the complete documentation index, see [llms.txt](https://www.revenuecat.com/docs/llms.txt).

Authentication is a RevenueCat feature that verifies the identity of each Customer. Use it to connect your identity provider to RevenueCat, and to secure the requests between the RevenueCat SDK and RevenueCat. Authentication is in private beta and is not broadly available yet. Most apps continue to identify Customers with [App User IDs](https://www.revenuecat.com/docs/customers/identifying-customers).

:::info[Private beta]

We want your feedback on Authentication. [Tell us about your use case](https://revenuecateventfeedback.typeform.com/to/bzxYhAjZ) to get early access and help us shape the feature.

:::

:::note[Authentication and API keys are different features]

This article is about the identity of your Customers. For the keys that authenticate your app and your server with RevenueCat, see [API Keys](https://www.revenuecat.com/docs/projects/authentication).

:::

## How authentication works

Authentication has three parts. Your **identity provider** authenticates the Customer. Auth0, Okta, and Firebase Authentication are common identity providers. An **authentication method** in your RevenueCat project tells RevenueCat which identity provider to trust. An **access token** from RevenueCat then identifies the Customer in each SDK request.

The three parts work together in this order:

1. The Customer logs in with your identity provider.
2. Your app receives an ID token from the identity provider.
3. Your app passes the ID token to the RevenueCat SDK. The SDK sends the token to the RevenueCat backend.
4. RevenueCat validates the ID token against the authentication method that you configured.
5. RevenueCat issues an access token for the Customer.
6. The SDK sends the access token with each request that follows.

Your app no longer provides an App User ID to the RevenueCat SDK. RevenueCat reads the App User ID from the access token instead. Each Customer can therefore read and change only their own data.

The access token is valid for a short time. The SDK gets a new access token when the current token expires.

## Authentication methods

You configure authentication methods for each project. The **Auth** section of your project shows the methods that you configured. RevenueCat supports two types of authentication method:

- **OpenID Connect (OIDC)**: any identity provider that follows the OpenID Connect standard.
- **Firebase Authentication**: a Firebase project. This method uses the Firebase project ID, the web API key, and the auth domain.

RevenueCat does not replace your identity provider. RevenueCat does not keep the passwords of your Customers, and it does not manage their accounts. Your identity provider owns both.

## Features that need authentication

Some operations are too sensitive for a public SDK API key, because it cannot prove which Customer sends the request. An access token can prove it, and it makes these features available:

- **Spend in-app currency from your app.** Your app debits the balance of the Customer who is logged in. Without authentication, only your server can spend a balance. See [In-App Currency](https://www.revenuecat.com/docs/offerings/virtual-currency).
- **Read Customer attributes from your app.** Your app reads the attributes of the Customer who is logged in. Without authentication, only your server can read attributes. See [Customer attributes](https://www.revenuecat.com/docs/customers/customer-attributes).
- **Secure the calls to your own backend.** Your app sends the RevenueCat access token to your backend. Your backend validates the signature of the token with the public keys of your project. Your backend then reads the App User ID from the token, and it does not need a separate session system.

## Limitations

- Authentication needs iOS SDK version 5.88.0 or later. The feature is behind an internal flag. We are working on support for Android, and support for the hybrid SDKs will follow.
- Your app must get an ID token from your identity provider before it can authenticate with RevenueCat. RevenueCat does not show a login screen in your app.

## Next steps

- [In-App Currency](https://www.revenuecat.com/docs/offerings/virtual-currency)
- [Authentication steps in funnels](https://www.revenuecat.com/docs/tools/funnels/creating-funnels#authentication-steps)
- [Trusted Entitlements](https://www.revenuecat.com/docs/customers/trusted-entitlements)