Single-SPA Authentication

Understanding authentication helps you work with single-spa confidently. Here you will learn the core ideas behind authentication, see working code, and pick up best practices used on real teams.

Authentication Overview

Authentication lets you structure single-spa work so it stays readable, testable, and easy to scale. Instead of ad-hoc code, you follow a clear pattern that other developers can recognise immediately.

The key is to keep authentication focused and predictable. Start from the minimal example here, then layer in only the complexity your feature actually needs.

import { registerApplication, start } from 'single-spa';

registerApplication({
  name: '@org/app',
  app: () => System.import('@org/app'),
  activeWhen: ['/app'],
});

start();

single-spa orchestrates multiple framework apps on one page through a root config.

Authentication Example

registerApplication({
  name: '@org/app',
  app: () => System.import('@org/app'),
  activeWhen: ['/app'],
});
start();

Start from a minimal Authentication example and grow it only as needed.
Keep configuration explicit so Authentication behaves the same in every environment.
Name things clearly so teammates understand your Authentication at a glance.
Add tests around Authentication early to lock in expected behaviour.

Single-SPA Cheatsheet

Core single-spa APIs related to authentication.

API	Example	Purpose
registerApplication	`registerApplication({ name, app, activeWhen })`	Register a micro frontend
activeWhen	`activeWhen: ['/checkout']`	Route ownership
start	`start()`	Begin routing
bootstrap	`export async function bootstrap()`	One-time setup
mount	`export async function mount(props)`	Render the app
unmount	`export async function unmount(props)`	Clean up the app
import map	`systemjs-importmap`	Locate app bundles

How Authentication Works in Single-SPA

Authentication is part of how single-spa lets multiple applications — even in different frameworks — coexist on one page. A root config registers each app and controls when it is active.

single-spa orchestrates multiple framework apps on one page through a root config.

A root config registers apps and calls start().
Each app exports bootstrap, mount, and unmount lifecycles.
activeWhen decides which routes each app owns.
Import maps resolve each app's bundle at runtime.

Practical Guidance for Authentication

For reliable micro frontends, authentication should isolate failures and keep shared state minimal. Let each team own its app end to end while agreeing on a few shared contracts.

Concern	Recommendation
Isolation	One app's crash should not break others
Shared state	Prefer shared utility modules over globals
Routing	Keep activeWhen rules explicit and non-overlapping
Deployment	Release via import-map updates per app

Common Mistakes

Skipping error handling and edge cases when wiring up authentication.
Leaving authentication untested, so regressions slip into production.
Over-engineering authentication before you actually need the extra flexibility.
Ignoring documentation, which makes authentication hard for the next developer to change.

Key Takeaways

Authentication is a core part of working effectively with single-spa.
Start small and keep authentication focused on a single responsibility.
Apply consistent patterns so authentication scales across your project.
Test and document authentication to keep it maintainable over time.

Pro Tip

When you get stuck on authentication, reduce it to the smallest reproducible example first — most single-spa issues become obvious once the noise is gone.