The Platform PM

Glossary and sources

Field Guide

Login and access for apps: authentication and authorization

10

Glossary and sources

5 min read · Chapter 10 of 10

Words that mean something else here

TermWhat you'd assumeWhat it means here
SSOA login featureOne company login for many apps; also the pricier plan that unlocks it
TokenA secret stringAn ID token says who signed in, an access token what an app may call, a refresh token gets new ones; JWT is just a format
ScopeA permissionWhat the user let an app do; the app still checks what the user may do
MFASecureTwo factors of any kind, including SMS and push, which can be phished
Phishing-resistantHard to foolCryptographically tied to the real site (passkeys, security keys); codes and push don't qualify
DeactivateRemoveMark a user inactive; sessions, tokens and keys may live on
Monthly active userOne definitionRetained users at Clerk, any identity operation at Cognito, users across linked tenants at Entra
MCP authorizationPermissions inside a toolOAuth between an AI client and a tool server; the tool's own permission checks are separate

What surprised me

Placeholders in your voice, drafted from the research and the earlier guides. Rewrite each with your own moment.

"Login is the hard part." I thought passwords and MFA would be the work. The leaks in the research came from permission checks.

"Removing a user removes access." In the KYB guide, offboarding meant closing an account. Here a deactivated user can keep a valid token until the app chases it down.

"SSO is a feature." It's also a price tier and a chain of fees: the customer pays the app, the app pays its identity vendor per connection, and the vendors campaigning against the SSO tax charge it one level down.

"Stronger login stops takeovers." Passkeys close the phishing door, and the expensive cases went around it, through a help desk, a recovery email or a stolen session cookie.

Sources

Undated entries were read on October 12, 2026; "search result" means seen only as a search snippet or summary. Company figures are self-reported unless they come from a filing or a regulator, vendor surveys cover the vendor's own customers or respondents, and list prices change often.

Standards and specifications

Rules and regulators

Attacks, flaws and security research

Passkeys

Companies, pricing and terms

Deals and funding

Incidents, settlements and filings

Reused from earlier guides on this site

Field Guides are learning notes, not legal or compliance advice. Rules and fees change; check the cited primary sources before you act on anything here.