How to Add User Authentication to a Replit App -- Build with AI

What You Are Actually Building

The goal is to protect pages so only logged-in users can access them. When this is done, you will have a login system where users register, verify their email, and access protected content. Non-technical builders complete this in Replit using Claude to write all the code — you describe what you want, Claude builds it, you test it and describe any fixes.

User authentication lets people log in to your app. Here is the simplest way to add it to a Replit Express app using Claude.

What You Need First

A Replit account (free tier is enough to start)
A database to store user credentials (Replit handles this)

You do not need to write any code. Claude handles all of it. Your job is to describe outcomes clearly and test what gets built.

How to Describe It to Claude

The most common mistake non-technical builders make is describing what they want at too high a level. "Add a database" is not specific enough. Claude needs to know: what data will be stored, what triggers the storage, who can access it, and what the data should look like when displayed back.

Start with the outcome, not the feature. Instead of "I need authentication," say "I need users to enter their email address, receive a six-digit verification code, and use that code to access a protected page at /dashboard."

Once Claude builds the first version, test it yourself. If something is wrong, describe the problem in plain language — what you expected to happen versus what actually happened. Claude fixes it. Repeat until it works correctly.

What the Working Version Looks Like

A correctly built version will have a login system where users register, verify their email, and access protected content. Run through the full user flow yourself before considering it done: create a test account, submit a test form, or make a test payment depending on what you built. If something breaks during your test, that is normal — paste the error message into Claude and describe what you were trying to do.

Common Mistakes and How to Fix Them

Describing too much at once — build one piece at a time, test it, then add the next
Trying to fix code directly instead of describing the problem to Claude in plain English
Not testing the full user flow — always go through every step a real user would take
Forgetting to set environment variables for API keys — never paste keys directly into code
Assuming it is broken when it just needs a page refresh or browser cache cleared

Frequently Asked Questions

How do I add user authentication to a Replit app?

Use Replit's built-in Auth feature for the fastest implementation -- Claude sets it up with a simple prompt. For custom authentication, ask Claude to build a session-based login with a users database table and password hashing.

What is the difference between Replit Auth and custom authentication?

Replit Auth is built into Replit and handles security automatically. Custom authentication gives you more control but requires more code. For most first implementations, Replit Auth is the right choice.

How do I protect certain pages so only logged-in users can access them?

Ask Claude to add authentication middleware to your Express routes. The middleware checks if a user is logged in and redirects to the login page if not. This applies to any route you specify.

Is password storage secure in Replit apps?

Only if passwords are hashed before storage. Ask Claude to use bcrypt for password hashing -- never store plain text passwords. Claude applies bcrypt automatically when building custom auth systems.

Can I add Google or GitHub login to my Replit app?

Yes -- Replit Auth supports Google and GitHub login out of the box. For custom OAuth implementations, Claude can write the code but it requires more setup time.