authenticate-apps

To add password protection to a Fastify app, a plugin routes first-time visitors to a /setup page to create credentials, then gates all non-allow-listed requests behind a /login screen using scrypt hashing and HMAC-signed session cookies.

Yes, React login flows work with Fastify session cookies via programmatic JSON auth endpoints like /api/auth/login, /api/auth/status, and /api/auth/logout, which support iframe-safe cookie behavior for frontend gating.

No, you do not need external dependencies for scrypt password hashing in Fastify beyond Node built-ins and the Fastify framework itself, as the authentication layer uses manual cookie parsing and timing-safe comparisons.

A self-bootstrapping credentials setup works by routing the first browser visit to a /setup flow where users create a username and password, which are then scrypt-hashed and persisted to a configured credentials path on disk.

The best way to bypass Fastify authentication gates for specific endpoints is to use an allowPaths configuration, which exempts designated routes like /api/health and /api/auth/* from the login gate while blocking all other requests.

A limitation of using HMAC-signed session cookies for sandbox app authorization is that cookie rotation behavior depends on a separate random secret, and all non-allow-listed requests are strictly blocked unless properly authenticated.