Overview
h1 — What this guide covers: This presentation explains the Gemini login experience for developers: authentication flows, session management, multi-factor approaches, and integration tips to keep user accounts secure while providing a smooth developer experience.
Why login security matters
h2 — Threat landscape: Credential theft and session hijacking are the two most common risks. Properly designing your login and token lifecycle reduces fraud, improves compliance, and protects user funds.
Core principles (h3)
1. Least privilege & short-lived tokens (h4)
Issue tokens with minimal scope and expiration. Prefer rotating refresh tokens to long-lived static keys.
2. Multi-factor authentication (h4)
Offer and require MFA for sensitive operations; support TOTP, WebAuthn and SMS (SMS only when stronger options unavailable).
3. Strong verification (h4)
Detect risky logins via IP, device fingerprinting, and behavioral heuristics. Introduce step-up authentication when risk is detected.
Authentication flows (h3)
h2 — Recommended flows: For web and API access use OAuth2 authorization code + PKCE. For machine-to-machine clients use client credentials with tightly-scoped access. For SDKs, store session tokens in secure storage (not localStorage) and follow platform best practices.
OAuth2 + PKCE (h4)
Authorization code with PKCE prevents interception on public clients. Use short-lived access tokens (minutes) and refresh tokens with rotation and revocation capabilities.
WebAuthn & hardware-backed keys (h4)
WebAuthn provides phishing-resistant authentication. When possible, prompt users to register a platform authenticator or a security key for high-value accounts.
Session & cookie management (h3)
Use secure, httpOnly cookies with SameSite attributes for browser sessions. For APIs, use Authorization headers. Implement session binding where a session token is tied to a device fingerprint when appropriate.
Logging & monitoring (h5)
Log authentication events, but avoid logging PII. Create alerts for repeated failed logins, new device enrollments, and unusual geographic access patterns.
Recovery & account safety (h5)
Design secure account recovery flows that require multiple verification factors. Avoid relying solely on email-based recovery for high-value accounts.
Developer checklist (h2)
- Use HTTPS everywhere (HSTS).
- Implement OAuth2 Authorization Code + PKCE for public clients.
- Rotate and revoke refresh tokens; detect replay.
- Require MFA for withdrawals and sensitive changes.
- Protect admin/developer endpoints with stricter authentication.
Example quick flow (h2)
1) Client initiates OAuth2 code request with PKCE. 2) User authenticates via Gemini login page and completes MFA. 3) Authorization code is returned to client. 4) Client exchanges code for short-lived access token + refresh token. 5) Client stores tokens securely and calls APIs with access token. 6) On suspicious activity, revoke refresh token and prompt re-authentication.