Built-in Auth & Permissions

All generated auth follows security best practices: passwords hashed with bcrypt (10 rounds), JWT access tokens with 15-minute TTL, refresh tokens stored in HTTP-only cookies (7 days), refresh token rotation on every use, and rate limiting on auth endpoints. We do not generate auth with known security shortcuts.

Yes. The RBAC system uses a configurable permission matrix stored in the codebase. You can add new roles, modify permissions, and create resource-level permission rules by editing the permission configuration file — without touching the core auth middleware logic.

The standard generation includes JWT auth and OAuth (Google, Microsoft, GitHub). SAML 2.0 and OIDC enterprise SSO integration (for Active Directory, Okta, Azure AD) is available as an enterprise add-on generation option. Enterprise auth is generated with the same quality and security standards as the standard auth.

The generated authentication includes all the technical controls PDPL requires for user authentication: encrypted credential storage, access logging, session management, and mechanisms for data subject rights (account deletion). You still need to implement the organisational controls (privacy notices, consent management) for full PDPL compliance.

Yes. icōd.ai can generate a hybrid auth system where users can register with email/password or link a Google/Microsoft/GitHub account. Account linking logic, conflict resolution (same email from different providers), and unified session management are all handled correctly in the generated code.