When a user signs in, your React app receives two tokens: an access token for calling your API and an ID token that tells the application who signed in. If you followed the Authorization Code flow with PKCE, you saw both tokens arrive in the token response.
It's not a secret that passwords are unsafe.
We ask users to invent a secret, remember it for years, never reuse it anywhere else, type it correctly on every device, and somehow keep it safe from attackers.
Every time a user clicks a "Sign In" button in your React app, it creates a small storm.
The browser jumps between URLs. Random-looking values appear in query parameters. Requests fly off to an identity server. Tokens come back. And a few seconds later, your app somehow knows exactly who the user is.
With a modern SDK like the WSO2 Identity Platform React SDK, all of that sits behind a single <SignInButton /> component. This is exactly the point of SDKs. Every time you need authentication, you shouldn't have to rebuild an entire authentication protocol.
The extensible, API-first platform to orchestrate identity for every human and AI agent at scale. 100% open source.