Design authentication for 10 million users.
Design authentication for 10 million users using a distributed, stateless JWT architecture with RS256, refresh token rotation, a fast cache (Redis) for revocation, and an API Gateway with rate limiting.
For 10 million users, you need a horizontally scalable, high-performance authentication system. The core components include: an Identity Provider (IdP) using OAuth2/OIDC (e.g., Keycloak, Auth0), an API Gateway (e.g., Kong, Envoy) for token validation and rate limiting, and a distributed cache (Redis Cluster) for token blacklist and user versioning. Use RS256 signing to enable stateless validation across services. Refresh token rotation prevents replay attacks and allows session revocation. Store refresh tokens in a database with TTL, but also keep a read replica for scaling.
- 1
User database: Partitioned by user ID (sharding) to handle 10M records; use PostgreSQL with read replicas or a NoSQL database like Cassandra.
- 2
Authentication flow: Login → IdP issues short-lived access token (15 min) and refresh token (7 days).
- 3
Revocation: User versioning in Redis (increment on logout/role change) invalidates all tokens instantly.
- 4
Rate limiting: Enforced at API Gateway per user ID (extracted from JWT).
- 5
Monitoring: Centralized logging (ELK) and metrics (Prometheus) for anomaly detection.
- 6
Security: All tokens stored in HttpOnly cookies with SameSite=Strict; strict CORS policy; Web Application Firewall (WAF).