Two Approaches to Authentication in Replit
Authentication -- letting users create accounts and log in -- is one of the more complex things to add to a web app. There are two practical approaches for Replit builds.
Approach 1 -- Replit Auth: Replit has a built-in authentication system that handles user registration, login, and sessions. It works with Google, GitHub, and email. Ask Claude to add Replit Auth to your app and it handles the implementation. Fastest path, least custom control.
Approach 2 -- Custom session authentication: Claude builds a custom login system with a users table in your database, password hashing, and session management. More code, more control, more customizable.
For most first auth implementations: use Replit Auth. It handles security correctly out of the box, requires no database schema for user management, and Claude implements it reliably. Build the custom version only if you need features Replit Auth does not support.
What to Ask Claude
For Replit Auth: "Add Replit Auth to my Express app. After login, redirect to /dashboard. Protect all routes under /dashboard so they require authentication -- unauthenticated users should be redirected to /login."
For custom auth: "Add session-based authentication to my Express app. Create a users table with email and hashed password. Build login and registration pages. Protect the /dashboard route."