How to implement authentication in Replit apps

Implementing authentication in a Replit app usually means choosing between two practical approaches: using Replit Auth (the built‑in “Login with Replit”) or using a traditional username/password or external OAuth provider inside your app. The simplest and most “Replit‑native” option is Replit Auth because it handles identity on Replit’s side and gives you a signed user token you can trust on your backend. But if you need users outside Replit, you’ll need to implement your own auth flow (for example, using bcrypt + sessions or JWT). Both approaches work well on Replit as long as you store secrets only in the Secrets tab and avoid writing any sensitive files to the project directory.

 

Replit Auth (built-in, simplest option)

 

This is best when your users have Replit accounts or your app mainly runs inside Replit. Replit Auth provides a signed JWT-like token that your server can decode and verify. You don’t manage passwords yourself — Replit handles login.

• Works with Node, Python, and most backend setups.
• You don’t store user passwords — safer and simpler.
• Has Replit-specific environment variables that your app can read.

Below is a minimal Node example using Express. This example uses the official Replit Auth environment variable REPLIT\_USER which contains a signed user token.

// server.js
import express from "express";
import jwt from "jsonwebtoken";

const app = express();
const PORT = 3000;

// Your Replit Auth public key. Add it in the Replit "Secrets" tab.
const REPLIT_PUBLIC_KEY = process.env.REPLIT_PUBLIC_KEY;

app.get("/me", (req, res) => {
  try {
    const token = req.headers["x-replit-user"]; // Provided by Replit Auth on the client
    if (!token) return res.status(401).json({ error: "Not logged in" });

    const user = jwt.verify(token, REPLIT_PUBLIC_KEY); // Verify signature
    res.json({ id: user.id, username: user.name });
  } catch (err) {
    res.status(401).json({ error: "Invalid token" });
  }
});

app.listen(PORT, () => console.log("Server running on port", PORT));

This works because Replit automatically gives the client-side environment access to the user token, which you forward to the backend via a header (like x-replit-user). The backend verifies the signature using your public key stored in Secrets. This keeps sensitive keys off your public source code.

 

Traditional email/password auth (for apps with non‑Replit users)

 

If your app has its own user base, you’ll want to build “normal” authentication. On Replit, the main difference is that you must:

• Store password hashes (never raw passwords).
• Use the Replit Secrets manager for things like JWT secrets or session keys.
• Avoid writing user data to the Replit filesystem because it resets on deployments. Use a database (Replit DB for simple cases, or PostgreSQL/Supabase/MongoDB for real apps).

Example of a minimal Node password-based auth using bcrypt + JSON Web Tokens:

// server.js
import express from "express";
import bcrypt from "bcrypt";
import jwt from "jsonwebtoken";

const app = express();
app.use(express.json());

const JWT_SECRET = process.env.JWT_SECRET; // Store in Secrets tab
const users = {}; // Replace with real DB in production

app.post("/signup", async (req, res) => {
  const { username, password } = req.body;

  if (users[username]) return res.json({ error: "User exists" });

  const hash = await bcrypt.hash(password, 10);
  users[username] = { hash };

  res.json({ success: true });
});

app.post("/login", async (req, res) => {
  const { username, password } = req.body;

  const user = users[username];
  if (!user) return res.status(401).json({ error: "Invalid credentials" });

  const ok = await bcrypt.compare(password, user.hash);
  if (!ok) return res.status(401).json({ error: "Invalid credentials" });

  const token = jwt.sign({ username }, JWT_SECRET, { expiresIn: "1h" });
  res.json({ token });
});

app.get("/me", (req, res) => {
  const auth = req.headers.authorization;
  if (!auth) return res.status(401).json({ error: "Missing token" });

  try {
    const token = auth.split(" ")[1];
    const data = jwt.verify(token, JWT_SECRET);
    res.json({ username: data.username });
  } catch {
    res.status(401).json({ error: "Invalid token" });
  }
});

app.listen(3000, () => console.log("Running"));

This approach works exactly like any backend app — Replit doesn’t impose special rules. Just remember not to store user data in normal files because deployments overwrite them. Use a persistent DB.

 

Common pitfalls on Replit

 

• Don’t store secrets in code. Always use the Secrets tab because your Repl is public by default.
• Don’t rely on filesystem storage for users. Replit’s workspace FS is not guaranteed persistent when deploying.
• Be careful with client‑side environment access. Secrets are not exposed to the client; only Replit Auth tokens are.
• If you use external OAuth (Google, Discord, etc.), whitelist your Repl’s URL and remember the URL changes when deploying to Replit Deployments.

 

When to choose which method

 

• Use Replit Auth if your users are mostly Replit users or you want instant login without handling passwords.
• Use your own password or OAuth system if you’re building a real standalone product with its own users.