Design an Authentication & Authorization Service

Platform & InfrastructureMediumdesign-auth-service

Design an Authentication & Authorization Service

Design identity for a platform: login, token issuance, permission checks on every request, and revocation that actually takes effect before the token expires.

OAuth2 / OIDCJWT vs Opaque TokensRBAC/ABACToken Revocation

Traffic & Capacity Estimates:

200M users · 500k token verifications/second · permission check under 5ms

Functional Requirements

•Authenticate via password, social login, and MFA, issuing short-lived access and refresh tokens.
•Verify tokens and evaluate permissions on every request across all services.
•Support role- and attribute-based rules, including per-resource and per-tenant scoping.
•Revoke individual sessions, all sessions for a user, and compromised client credentials.

Non-Functional Requirements

•Verification must not require a call to the auth service on every request.
•Revocation must propagate globally within 30 seconds.
•A compromised signing key must be rotatable without logging out every user at once.

Back-of-the-Envelope Math

500k verifications/second is the entire authenticated request volume — local JWT verification is what makes this affordable.
A revocation deny-list of 1M entries with a 15-minute access-token TTL is ~50 MB replicated to every service.

Key Architectural Trade-offs

Self-contained JWTs verify locally with no round-trip and cannot be un-issued; opaque tokens are revocable on the spot and add an introspection hop to every request.
Short access tokens plus refresh tokens bound the damage of a leak without paying for a lookup per call — the refresh endpoint becomes the thing to protect.
Centralized policy evaluation is consistent and auditable; embedding permissions in the token is fast and goes stale the moment a role changes.

Click or drag a component onto the canvas, then connect the handles to draw the data flow.

3 nodes · 2 edges

Components · 35

Client & Edge4

Compute & Gateway7

Storage & Caching11

Messaging & Streaming6

Coordination & Ops5

Intelligence2

React Flow