Authentication - Authorisation

Does someone has a clear view of what to do, best practice? Or am I throwing a bottle in the ocean...

The ocean is: __Passwords, magic link, OPT, Authenticator, Passkey, OAuth, third-party......__

- for an API, for Liveview, for Phoenix, for channels
- usingJWT/Oauth/Authenticator/OTP./Passkey (for the devices that can use it..... )???

In particular, I understand the Phoenix generates a session token when a user connects. This token is accessible "on mount" (the HTTP call) by the LiveView and put into the socket

[](https://hexdocs.pm/phoenix/mix_phx_gen_auth.html)

There is also 2FA using an authenticator.


[](https://dashbit.co/blog/introducing-nimble-totp)


And [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor)


[](https://en.wikipedia.org/wiki/Universal_2nd_Factor)


A comparison between One Time Password and U2F: (same wiki source as above





I saw an "old" post of this:

[](https://peterullrich.com/uf2-with-phoenix-live-view)


What about OAthu? Christian Alexander is one of my favorite guy on YT.


[](https://www.youtube.com/watch?v=tpIXmmV4ib4)


Passkey with SimpleWebAuthn
[](https://simplewebauthn.dev/docs/advanced/passkeys)


or the WIP:
[](https://github.com/liveshowy/webauthn_components)