--- title: How does Authentication Work? - TrueVault description: How does Authentication Work? - TrueVault --- - [CCPA](https://safe.truevault.com/learn/ccpa/what-is-the-ccpa) - [GDPR Compliance](https://safe.truevault.com/gdpr-guide) - [Personal Data](https://safe.truevault.com/learn/what-is-personal-data) - [DSAR](https://safe.truevault.com/learn/explaining-gdpr-data-subject-requests) - [HIPAA](https://safe.truevault.com/learn/hipaa) - [HIPAA Compliance](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [Personally Identifiable Information](https://safe.truevault.com/blog/what-is-phi) - [PHI](https://safe.truevault.com/protected-health-information) - [Resources](https://safe.truevault.com/learn/) - [Resource Center](https://safe.truevault.com/learn/) - [TrueVault Safe](https://safe.truevault.com/help/truevault-safe) - [About](https://safe.truevault.com/about-us) - [Contact](https://safe.truevault.com/contact-us) - [Careers](https://careers.truevault.com/) - Solutions - [GDPR Compliance](https://safe.truevault.com/solutions/gdpr-compliance) - [HIPAA Compliance](https://safe.truevault.com/hipaa-compliance) - [For Applications](https://safe.truevault.com/solutions/application-compliance) - [For Data Exchanges](https://safe.truevault.com/solutions/data-exchange-compliance) - [Developers](https://safe.truevault.com/resources/index) - [Pricing](https://safe.truevault.com/safe-pricing) - [Blog](https://safe.truevault.com/blog) - [Login](https://console.truevault.com/login) - [Get Started](https://safe.truevault.com/get-started) Resources - [Home](https://safe.truevault.com/homepage-v3?hsLang=en) - [Resources](https://safe.truevault.com/resources/index?hsLang=en) - How does Authentication Work # How does Authentication Work? TrueVault has several authentication mechanisms that support the main access patterns our customers use. This primer will give you a quick overview of how to authenticate in these common scenarios. ## End Users When your end users connect to TrueVault, they need to authenticate to access their data. We recommend you make these connections directly from your client application, not from your server side, to ensure sensitive data doesn’t pass through your servers. End users authenticate with passwords and User Access Tokens. We recommend that every human being who uses your product is represented by a user in TrueVault. This ensures accurate and compliant audit logs and allows you to leverage our flexible access control rules. You can read more about building the registration process for end users [here](https://safe.truevault.com/resources/developer/how-do-I-implement-user-registration?hsLang=en). ### Passwords When your end-users open your application after they’ve been inactive, you should ask them to log in. Login requests should be made directly from your client application to the [TrueVault login](https://docs.truevault.com/authentication#login-a-user) endpoint, which accepts the username and password for this user. TrueVault manages the password verification and secure password storage for you, so your system never has to interact with these sensitive bits of data. If the login request succeeds, TrueVault returns a User Access Token. ### User Access Tokens Aside from the login endpoint, all requests that are made by end-users should use a User Access Token for authentication. User Access Tokens are returned by the [login](https://docs.truevault.com/authentication#login-a-user) endpoint. By default, they expire after 24 hours but you can always revoke them sooner by calling the [logout](https://docs.truevault.com/authentication#logout-a-user) endpoint. You can use a User Access Token for any request you make to TrueVault. You pass it in the Basic Auth Header by base64-encoding the User Access Token (after appending a `:` to it). Read our [authentication docs](https://docs.truevault.com/overview#authentication) for details on how to form the auth header. ### Advanced: User MFA On our Advanced Security plan, you can offer your users MultiFactor Authentication to protect their logins from social engineering attacks. MultiFactor Authentication is a good practice for all users, but it is especially important for any high-privilege users in your systems, like administrators, since a compromise to their account generally has a bigger impact. Check out our [detailed guide](https://safe.truevault.com/resources/developer/where-can-I-find-user-mfa-sample-code?hsLang=en) on adding User MFA to your application, or contact [sales@truevault.com](mailto:sales@truevault.com?subject=User%20MFA) to enable User MFA in your account. ## System Users System users do not represent human beings; they represent background processes or asynchronous tasks. They use non-expiring [API Keys](https://docs.truevault.com/overview#api-keys) instead of passwords and transient User Access Tokens. API Keys are added to the [Basic Auth Request](https://docs.truevault.com/overview#building-the-auth-header) header just like User Access Tokens. ### When to use a System User? Imagine you need to send a nightly reminder to all doctors who haven’t submitted their daily notes to your product. You’d probably run this analysis on your own server operating on de-identified metadata (i.e. whether the notes were submitted, not what their contents are. More on de-identification [here](https://safe.truevault.com/resources/developer/what-is-data-de-identification?hsLang=en).) To send the emails, you’d probably want to use TrueVault’s [Email API](https://docs.truevault.com/messaging). To connect to that API, you’d need to authenticate as a user. In this case, there’s no end-user or human being that is taking this action; the system is sending this email. So, you would create a System User in the [console](https://console.truevault.com) or through the [api](https://docs.truevault.com/users#create-a-user). It doesn’t make sense for this user to have a password, since no human will log in as this user. You can leave the password blank. Once the user has been created, you should note the API Key for the user. In the console, you can find the API Key by clicking the “REASSIGN” button in the user view. This will invalidate the old API Key and generate a new one (users can only have one at a time). You can accomplish the same task through the API using the [Create API Key](https://docs.truevault.com/users#create-api-key-for-a-user). ### Skip the login dance If you have a background process or a script that needs to connect to TrueVault, API Keys are the right choice. Since they don’t expire, you can set them in a config file and leave them alone until you decide to rotate them. This saves you from managing expired User Access Tokens and login requests in your script, which cuts down on complexity, error cases, and API Requests. ## Other? Does your application have authentication needs that aren’t met by these strategies? Shoot us an [email](mailto:help@truevault.com?subject=Authentication) or ask away on Stack Overflow (tag it truevault so we see.). ### Latest Posts ## [Should Utah's Privacy Law Be on Your Radar?](https://safe.truevault.com/blog/utah-privacy-law-does-it-apply?hsLang=en) Phillip Walters / November 17, 2022 ## [Connecticut’s Privacy Law: Does It Apply to Your Business?](https://safe.truevault.com/blog/connecticut-privacy-law-does-it-apply?hsLang=en) Phillip Walters / November 10, 2022 ## [Global Privacy Control: A New Requirement for Compliance](https://safe.truevault.com/blog/global-privacy-control?hsLang=en) Phillip Walters / November 7, 2022 ### Mailing List ### Company - [Blog](https://safe.truevault.com/blog) - [Contact Us](https://safe.truevault.com/contact-us-2019) - [Careers](https://truevault.workable.com) - [HIPAA Compliance Checklist](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [PDF: Developers Guide to HIPAA compliance](https://my.leadpages.net/leadbox/14472b173f72a2%3A131fd12f8b46dc/5760820306771968/) ### Developers - [Patterns](https://safe.truevault.com/patterns) - [Documentation](https://docs.truevault.com/) - [Quick Start Guide](https://safe.truevault.com/quick-start-guide) - [Secure Infrastructure](https://safe.truevault.com/secure-infrastructure) - [API Overview](https://safe.truevault.com/api-overview) ### Latest Posts ### Contact Us 201 Mission Street, 12th Floor San Francisco, CA 94105 Email: [hello@truevault.com](mailto:hello@truevault.com) 2021 © All Rights Reserved. [Privacy Policy](https://privacy.truevault.com/privacy-policy) | [Terms of Service](https://safe.truevault.com/terms-of-service?hsLang=en) - - -