# @loopback/authentication

> A LoopBack component for authentication support.

Latest version **13.0.0** (published 2026-10-24) · MIT license · 0 weekly downloads

## Install

```sh
npm install @loopback/authentication
pnpm add @loopback/authentication
yarn add @loopback/authentication
bun add @loopback/authentication
```

## Health

**Score 65/100 (B)** — status: active.

Positive: has types; no vulnerabilities; recently updated; high maintenance score; high quality score.

Warnings: low downloads; no esm support.

## Facts

| | |
|---|---|
| Version | 13.0.0 |
| Published | 2026-10-24 |
| First published | 2017-05-30 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Node | 22 \|\| 24 \|\| 26 |
| Dependencies | 5 |
| Unpacked size | 92.1 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 5102 |
| Author | IBM Corp. and LoopBack contributors |
| Maintainers | rfeng, rmg, dhmlau, theprez, frbuceta, marioestradarosa, achrinza |
| Keywords | LoopBack, Authentication |

## Links

- npm: https://www.npmjs.com/package/@loopback/authentication
- Repository: https://github.com/loopbackio/loopback-next
- Homepage: https://github.com/loopbackio/loopback-next#readme
- Issues: https://github.com/loopbackio/loopback-next/issues
- npm.io page: https://npm.io/package/@loopback/authentication

## Dependencies (5)

- [tslib](https://npm.io/package/tslib.md) ^2.8.1
- [lodash](https://npm.io/package/lodash.md) ^4.18.1
- [@types/lodash](https://npm.io/package/@types/lodash.md) ^4.17.27
- [@types/express](https://npm.io/package/@types/express.md) ^4.17.25
- [@loopback/security](https://npm.io/package/@loopback/security.md) ^0.13.0

## Alternatives

- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
- [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads
- [escher-request](https://npm.io/package/escher-request.md) — 545 weekly downloads

## Recent versions

- 13.0.0 (latest) — 2026-10-24
- 0.11.0 (dp3) — 2018-07-20
- 0.8.0 (dp2) — 2018-04-16
- 4.0.0-alpha.17 (dp1) — 2017-11-29
- 12.0.17 — 2026-08-18
- 12.0.16 — 2026-07-16
- 12.0.15 — 2026-06-11
- 12.0.14 — 2026-05-12
- 12.0.13 — 2026-04-14
- 12.0.12 — 2026-03-11
- 12.0.11 — 2026-02-10
- 12.0.10 — 2026-01-12
- 12.0.9 — 2025-12-09
- 12.0.8 — 2025-11-11
- 12.0.7 — 2025-10-15
- … 226 more at https://npm.io/package/@loopback/authentication/versions

## README

# @loopback/authentication

A LoopBack 4 component for authentication support. Its corresponding
documentation is in
[LoopBack component authentication](https://loopback.io/doc/en/lb4/Loopback-component-authentication.html)

## Overview

![AuthenticationComponent](https://raw.githubusercontent.com/loopbackio/loopback-next/master/packages/authentication/docs/imgs/authentication_overview_highlevel.png)

This component contains the core logic for the authentication layer in
LoopBack 4.

It contains:

- A decorator to express an authentication requirement on controller methods
- A provider to access method-level authentication metadata
- An action in the REST sequence to enforce authentication (**No longer needed
  for middleware based sequence**)
- An extension point to discover all authentication strategies and handle the
  delegation

## Installation

```shell
npm install --save @loopback/authentication
```

## Basic Use

[Load the AuthenticationComponent](https://loopback.io/doc/en/lb4/Loopback-component-authentication.html#mounting-authentication-component)
into your application.

**Extension developers** need to:

- [create custom authentication strategies](https://loopback.io/doc/en/lb4/Implement-your-own-strategy.html)

**Application Developers** need to:

- [decorate controller functions with the authentication decorator](https://loopback.io/doc/en/lb4/Authentication-component-decorator.html)
- [add the authentication action to a custom sequence](https://loopback.io/doc/en/lb4/Authentication-component-action.html#adding-an-authentication-action-to-a-custom-sequence)
  and
  [bind the custom sequence to the application](https://loopback.io/doc/en/lb4/Authentication-component-action.html#binding-the-authenticating-sequence-to-the-application)
  (**No longer needed for middleware based sequence**)
- [register the authentication strategies](https://loopback.io/doc/en/lb4/Authentication-component-strategy.html)

[Create and register a passport based strategy](https://loopback.io/doc/en/lb4/Authentication-passport.html)

## Related resources

For detailed documentation, see
[AuthenticationComponent](https://loopback.io/doc/en/lb4/Loopback-component-authentication.html).

For a tutorial on how to add **JWT** authentication to an application, see
[How to secure your LoopBack 4 application with JWT authentication](https://loopback.io/doc/en/lb4/Authentication-tutorial.html).

For some background on our design decisions, please read
[Multiple Authentication strategies](./docs/authentication-system.md).

## Note

Starting from version `@loobpack/authentication@3.0.0`, `UserProfile` needs to
be imported from @loopback/security and it's not backward compatible with the
one exported from `@loobpack/authentication@2.x`. Make sure you follow the
[new tutorial](https://loopback.io/doc/en/lb4/Loopback-component-authentication.html)
to build the authentication system.

## Contributions

- [Guidelines](https://github.com/loopbackio/loopback-next/blob/master/docs/CONTRIBUTING.md)
- [Join the team](https://github.com/loopbackio/loopback-next/issues/110)

## Tests

run `npm test` from the root folder.

## Contributors

See
[all contributors](https://github.com/loopbackio/loopback-next/graphs/contributors).

## License

MIT

---
_Source: https://npm.io/package/@loopback/authentication · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._