OAuth & Authentication

Experience with OAuth & Authentication

Authentication and authorization architecture is a critical specialty for Pablo Diaz, given that OpenMyPro handles Protected Health Information (PHI) under HIPAA regulations where authentication failures can lead to compliance violations, data breaches, and legal liability. Pablo's auth expertise spans the complete authentication lifecycle: OAuth 2.0 / OpenID Connect integration with Google and Apple sign-in, email/password with bcrypt hashing and salt, magic link (passwordless) authentication, phone OTP verification, JWT token management with refresh token rotation, session handling through HTTP-only cookies, multi-factor authentication (MFA/2FA), and role-based access control (RBAC) across patient, provider, and admin roles. The authentication architecture for OpenMyPro is built on Supabase Auth, which provides a battle-tested, open-source authentication layer that supports all of these methods out of the box. Pablo's implementation extends Supabase Auth with Next.js middleware that runs at the edge — verifying session tokens and redirecting unauthenticated users before the request even reaches the application server. This edge-based auth pattern reduces latency by 200-300ms compared to server-side session verification and prevents unauthorized requests from consuming serverless function invocations. Row Level Security policies in Supabase PostgreSQL provide the second layer of defense — even if a session is compromised, the database enforces role-based data access independently of the application code. WeTalkin's zero-knowledge authentication system pushed Pablo's auth expertise even further — implementing a system where the server verifies user identity without ever having access to the actual credentials, using cryptographic proof-of-knowledge protocols. This experience with zero-knowledge architectures provides a unique perspective on authentication design that few developers possess. Pablo's auth architecture has maintained zero security incidents across all Blossend platforms, protecting data for 150K++ users while supporting the frictionless 33-second booking flow that cannot tolerate authentication-related delays or friction.

Frequently Asked Questions