Custom authentication in [LangGraph](https://docs.langchain.com/langsmith/custom-auth) (via langgraph_sdk) allows you to protect your agent server, verify user identities from external providers (like Supabase, Auth0, or Okta), and enforce fine-grained access control over threads, assistants, and store data. [1, 2, 3]
------------------------------
## How It Works
The authentication flow relies on three core pieces working together: an Identity Provider, the LangGraph Backend, and the Client Application: [2]
1. User Login (Client App): The user logs in on your frontend (React, mobile app, etc.) using an external authentication service like Supabase or Auth0. [2, 4]
2. Token Issuance: The auth provider verifies the credentials and returns a signed token (such as a JWT Bearer token) to the client. [4]
3. Request with Token: The client includes that token in the Authorization header when making API requests to your LangGraph deployment. [4, 5]
4. Server Verification (@auth.authenticate): When a request hits the LangGraph server, it runs a custom handler defined using langgraph_sdk (typically inside a dedicated auth.py file).
* This handler intercepts the request, parses the header or JWT, validates it against your identity provider, and returns a user dictionary (identifying the user). [1, 3, 6, 7]
5. Authorization (@auth.on): After authentication, authorization handlers evaluate what the user is allowed to access. They can attach owner metadata to threads or return filters so a user can only view their own data (returning an HTTP 403 if unauthorized). [1, 7, 8, 9]
6. Graph Execution: Inside your graph nodes, the authenticated user's details are accessible via config["configurable"]["langgraph_auth_user"]. [6]
------------------------------
## Key Components to Implement
* The Auth File (auth.py): Uses the Auth class from langgraph_sdk with decorators like @auth.authenticate to validate credentials and @auth.on to control resource-level permissions.
* Configuration (langgraph.json): You register your custom auth script path under the auth configuration field so the LangGraph server loads it automatically: [1, 3, 8]
{
"auth": {
"path": "./auth.py:my_auth"
}
}
If you're setting this up right now, let me know:
* Which authentication provider you plan to use (e.g., Supabase, Auth0, custom JWT)
* Whether you need help writing the @auth.authenticate or @auth.on code handlers
[1] [https://www.langchain.com](https://www.langchain.com/blog/custom-authentication-and-access-control-in-langgraph)
[2] [https://docs.langchain.com](https://docs.langchain.com/langsmith/auth)
[3] [https://reference.langchain.com](https://reference.langchain.com/python/langgraph-sdk/auth)
[4] [https://github.com](https://github.com/langchain-ai/custom-auth)
[5] [https://www.youtube.com](https://www.youtube.com/watch?v=g7s_6t5Jm4I&t=505)
[6] [https://docs.langchain.com](https://docs.langchain.com/langsmith/custom-auth)
[7] [https://github.com](https://github.com/langchain-ai/custom-auth/blob/main/README.md)
[8] [https://reference.langchain.com](https://reference.langchain.com/python/langgraph-sdk/auth/Auth)
[9] [https://docs.langchain.com](https://docs.langchain.com/langsmith/resource-auth)
