---
title: "Auth"
description: "Sign users in with Fabric SSO — Rayfin's managed sessions, per-user data isolation, and one client API for every deployed app."
url: https://rayfin.ai/docs/auth
markdown_url: https://rayfin.ai/docs/auth.md
section: auth
product: Rayfin
sdk_version: 1.34.0
cli_version: 1.33.2
last_updated: 2026-08-29T23:37:34-07:00
source: auth/index.mdx
---

# Auth

> Sign users in with Fabric SSO — Rayfin's managed sessions, per-user data isolation, and one client API for every deployed app.

Rayfin Auth gives you managed sign-in and session handling without building an identity
service yourself. Enable it in `rayfin.yml`, call `ensureSignedInWithFabric(client.auth,
...)`, and every `client.data.*` call after that automatically carries the authenticated
context — no manual header or token passing between modules.

## Why use Rayfin Auth [#why-use-rayfin-auth]

* **Zero auth infrastructure** — sessions and token handling work with no external identity
  service to deploy or configure.
* **Pre-integrated with data** — after sign-in, every `client.data.*` call automatically
  carries the authenticated context.
* **Automatic per-user data isolation** — JWT claims drive the row-level security policies
  you declare on your entities (see [Permissions](/docs/data/permissions)), so each user
  sees only the data they own without hand-written SQL.
* **One client API** — `getSession`, `onSessionChange`, and `signOut` work the same way no
  matter which Fabric SSO flow (popup or embedded) signed the user in.

## Fabric SSO is the only auth method [#fabric-sso-is-the-only-auth-method]

Rayfin apps sign users in with the Microsoft Entra identity they already used to open the
Fabric portal. There's no separate login form, sign-up step, or password to manage — the
user authenticates once in Fabric and the app inherits that session.

> [!NOTE]
> Sign-in works from a local dev server as well as from the deployed app. The popup flow
> returns its handoff code to any origin listed in `allowedRedirectUris`, including
> `http://localhost:5173` — what it requires is a *backend* deployed to Fabric. Only the
> embedded (iframe) flow needs the app itself to be running inside the Fabric portal. See
> [Fabric SSO](/docs/auth/fabric-sso) for both flows.

## Configuring auth [#configuring-auth]

Enable the service and Fabric SSO in `rayfin/rayfin.yml`:

```yaml title="rayfin/rayfin.yml"
services:
  auth:
    enabled: true
    allowedRedirectUris:
      - http://localhost:5173
    fabric:
      enabled: true
```

Redeploy (`npx rayfin up`) after changing this file — auth settings are synced to the
remote service on every deploy. See [Redirect URIs](/docs/hosting/redirect-uris) for what
`allowedRedirectUris` controls.

## In this section [#in-this-section]

* **[Fabric SSO](/docs/auth/fabric-sso)** — enable it, install the provider package, and
  call `ensureSignedInWithFabric`.
* **[Sessions](/docs/auth/sessions)** — the opaque session object, `onSessionChange`, and
  token handling.
* **[Delegated access](/docs/auth/delegated-access)** — how functions, connectors, and
  entity policies use the signed-in user's identity.
* **[React integration](/docs/auth/react)** — an auth context, a hook, and route guarding.

```prompt title="Wire up Rayfin auth with Fabric SSO"
In my Rayfin app, set up authentication:

- In rayfin/rayfin.yml, enable services.auth with fabric.enabled: true, and keep
  allowedRedirectUris scoped to my app's own origin(s), including http://localhost:5173 for
  local frontend development.
- Install @microsoft/rayfin-auth-provider-fabric and call ensureSignedInWithFabric from a
  button click handler for the popup flow, plus initEmbeddedAuth in a startup effect for
  the embedded/iframe flow.
- Use onSessionChange to react to session changes — onAuthStateChange does not exist on the
  Rayfin auth client. Gate UI on isAuthenticated or the presence of a user object, never on
  session internals.

Explain which files you changed and how to test sign-in.
```