# Authentication

> Auth concepts, tokens, MFA, step-up auth, and access control.

- [Best Practices](https://www.dynamic.xyz/docs/auth/best-practices.md) — Security and authentication best practices for Dynamic — JWT management, session configuration, MFA, CORS, and protecting your backend.
- [Bring Your Own Auth](https://www.dynamic.xyz/docs/auth/bring-your-own-auth.md) — Use your own authentication provider with Dynamic. Exchange your JWT for a Dynamic session to access wallets, user management, and SDK features.
- [Concepts](https://www.dynamic.xyz/docs/auth/concepts.md) — Core concepts in Dynamic authentication: Users, Sessions, Wallets, and Visitors.
- [Cookie-based authentication](https://www.dynamic.xyz/docs/auth/cookie-authentication.md) — Use a secure, HttpOnly cookie instead of localStorage for Dynamic's JWT — how it works, setup steps, and verification checklist.
- [Multi-Factor Authentication (MFA)](https://www.dynamic.xyz/docs/auth/mfa.md) — Overview of MFA in Dynamic — TOTP and Passkey methods, when MFA is triggered, and links to SDK implementation guides.
- [Overview](https://www.dynamic.xyz/docs/auth/overview.md) — What authentication and authorization mean with Dynamic, what methods are available, and how to choose between Dynamic Auth and Bring Your Own Auth.
- [Revoking Sessions](https://www.dynamic.xyz/docs/auth/revoking-sessions.md) — How to end user sessions in Dynamic: client-side logout, server-side revocation via API, and webhook events.
- [Step-Up Authentication](https://www.dynamic.xyz/docs/auth/step-up-auth.md) — Require users to re-verify their identity before sensitive actions using elevated access tokens. Includes re-auth (email, SMS, social/OAuth, wallet) and MFA (passkey, TOTP, recovery codes).
- [Tokens](https://www.dynamic.xyz/docs/auth/tokens.md) — Understanding Dynamic-issued JWTs: structure, claims, storage, verification keys, and how to verify tokens on your backend.
- [Auth webhooks](https://www.dynamic.xyz/docs/auth/webhooks.md) — Events emitted for users, sessions, sign-ins, linked credentials, and passkey recovery.

### Access Control

- [Access Lists](https://www.dynamic.xyz/docs/auth/access-control/access-lists.md) — Allow or restrict access using lists of emails, wallet addresses, or other identifiers. Works with any SDK; scopes and UI customization are SDK-specific.
- [Gates](https://www.dynamic.xyz/docs/auth/access-control/gates.md) — Define rules that combine criteria such as access list membership or NFT/token ownership. Works with any SDK; scopes and UI are SDK-specific.
- [Overview](https://www.dynamic.xyz/docs/auth/access-control/overview.md) — Control who can use your app or parts of it using access lists and gates. Works with any integration; scopes require an SDK.

### Dynamic Auth

- [Architecture / Flow](https://www.dynamic.xyz/docs/auth/dynamic-auth/architecture-flow.md) — How authentication is performed between the client/end-user and Dynamic.
- [Auth methods](https://www.dynamic.xyz/docs/auth/dynamic-auth/auth-methods.md) — Authentication methods provided by Dynamic — email, SMS, web3 wallets, social login, passkey — with links to SDK implementation guides.
- [Protecting your servers](https://www.dynamic.xyz/docs/auth/dynamic-auth/protect-servers.md) — Use the Dynamic-issued JWT to protect your backend — Client / end-user ↔ Customer servers.