Custom software

# App Authentication: Login You Can Reset Without SSH

Authentication is accounts, roles, and a reset path your operator can run. A library name on a slide is not a login.

CodeLoop Studio·August 27, 2026·5 min read

![Person typing on a laptop](https://www.codeloop.ba/_next/image?url=%2Fblog%2Fapp-authentication-cover.jpg&w=3840&q=75)

Photo by [cottonbro studio](https://www.pexels.com/@cottonbro) on [Pexels](https://www.pexels.com/photo/5380642/)

Authentication is accounts, roles, and a reset path your operator can run without SSH. A library name on a slide is not a login. If only we can unlock a user, you do not operate the product.

CodeLoop Studio in Sarajevo builds that into web apps and mobile products. A logged-in daily tool is [web app development](https://www.codeloop.ba/blog/izrada-web-aplikacija). Pipeline software is [custom CRM](https://www.codeloop.ba/blog/custom-crm). [Hena Em](https://www.codeloop.ba/study-case/hena-em) is reservations and vehicles — staff log in, permissions matter, the owner is not waiting on us for a password.

## Sessions, not a magic SDK

We pick the stack after the threat model: email magic link, password, SSO if you already have an IdP. We will not drop an open-source “locker” into a client app because a conference talk used that word. You keep the user table. Tokens expire. Refresh is boring on purpose.

SaaS with more than one tenant is a different freeze — [SaaS development agency](https://www.codeloop.ba/blog/saas-development-agency). A marketing site with a password field is still a brochure. We will say so.

## What we freeze

* **Roles before UI.** Sales does not see every record. That drawing happens in discovery, not as a toggle in week twelve.
* **Admin reset.** Someone on your side can unlock an account. If the only path is our laptop, the engagement model failed.
* **Your IdP when you have one.** We will not invent a second password database because it was faster to sketch.
* **No “blockchain login.”** If the brief is a wallet for its own sake, read [when not to build blockchain](https://www.codeloop.ba/blog/when-not-to-build-blockchain). Most businesses need a session, not a public ledger of who signed in.

## Legacy logins

Taking over a product where the previous vendor is the only admin is a takeover first — [legacy project takeover](https://www.codeloop.ba/blog/take-over-legacy-project). We will not clone credentials we cannot rotate.

## Send who must get in

Roles, whether you already have Google or Microsoft login, and who resets a lockout at 7:00\. Reply in **24 hours** — [online estimate](https://www.codeloop.ba/online-estimate) or [contact](https://www.codeloop.ba/contact).