# Auth overview

Mastra lets you choose how you handle authentication, so you can secure access to your API and [Studio](https://mastra.ai/docs/studio/overview) using the identity system that fits your stack.

You can start with basic shared secret JWT authentication and switch to known providers when you need more advanced identity features.

## What auth secures

Configuring authentication locks down two things at once:

- **Studio UI**: Studio displays a login screen (SSO, email/password, or both) and enforces role-based access control to determine what each team member can see and do.
- **API routes**: All built-in routes (`/api/agents/*`, `/api/workflows/*`, etc.) and custom routes require authentication, whether requests come from Studio or direct API calls.

Authentication is optional. If no auth is configured, all routes and Studio are publicly accessible. Public access can be enabled on individual custom routes using `requiresAuth: false`.

See [Custom API Routes](https://mastra.ai/docs/server/custom-api-routes) for controlling authentication on custom endpoints. Visit the [Studio Auth docs](https://mastra.ai/docs/studio/auth) for more on securing your Studio deployment.

> **Note:** Authentication for Studio is currently supported by the following providers: Simple Auth, JWT, WorkOS, and Better Auth.

## Available providers

### Built-in

- [Simple Auth](https://mastra.ai/docs/server/auth/simple-auth): Token-to-user mapping for development and API keys
- [JSON Web Token (JWT)](https://mastra.ai/docs/server/auth/jwt): HMAC-signed JWT verification

### Third-party integrations

- [Auth0](https://mastra.ai/docs/server/auth/auth0)
- [Better Auth](https://mastra.ai/docs/server/auth/better-auth)
- [Clerk](https://mastra.ai/docs/server/auth/clerk)
- [Firebase](https://mastra.ai/docs/server/auth/firebase)
- [Okta](https://mastra.ai/docs/server/auth/okta)
- [Supabase](https://mastra.ai/docs/server/auth/supabase)
- [WorkOS](https://mastra.ai/docs/server/auth/workos)

### Advanced

- [Composite Auth](https://mastra.ai/docs/server/auth/composite-auth): Combine multiple auth providers
- [Custom Auth Provider](https://mastra.ai/docs/server/auth/custom-auth-provider): Build your own provider