Shared Authentication

Understanding shared authentication helps you work with single-spa confidently. Here you will learn the core ideas behind shared authentication, see working code, and pick up best practices used on real teams.

Shared Authentication Overview

Shared Authentication is a building block you will reach for often in single-spa. It keeps related logic together and makes your intent obvious to reviewers and future maintainers.

When you learn shared authentication properly, you avoid the guesswork that leads to bugs and rework. The example below shows the shape you will use in most real single-spa projects.

// shared utility module exposed via the import map
export const authService = {
  getToken: () => localStorage.getItem('token'),
};

// consumed by any micro frontend
import { authService } from '@org/utils';

Shared utility modules provide cross-app services like auth without tight coupling.

Shared Authentication Example

registerApplication({
  name: '@org/app',
  app: () => System.import('@org/app'),
  activeWhen: ['/app'],
});
start();

Start from a minimal Shared Authentication example and grow it only as needed.
Keep configuration explicit so Shared Authentication behaves the same in every environment.
Name things clearly so teammates understand your Shared Authentication at a glance.
Add tests around Shared Authentication early to lock in expected behaviour.

Single-SPA Cheatsheet

Core single-spa APIs related to shared authentication.

API	Example	Purpose
registerApplication	`registerApplication({ name, app, activeWhen })`	Register a micro frontend
activeWhen	`activeWhen: ['/checkout']`	Route ownership
start	`start()`	Begin routing
bootstrap	`export async function bootstrap()`	One-time setup
mount	`export async function mount(props)`	Render the app
unmount	`export async function unmount(props)`	Clean up the app
import map	`systemjs-importmap`	Locate app bundles

How Shared Authentication Works in Single-SPA

Shared Authentication is part of how single-spa lets multiple applications — even in different frameworks — coexist on one page. A root config registers each app and controls when it is active.

Shared utility modules provide cross-app services like auth without tight coupling.

A root config registers apps and calls start().
Each app exports bootstrap, mount, and unmount lifecycles.
activeWhen decides which routes each app owns.
Import maps resolve each app's bundle at runtime.

Practical Guidance for Shared Authentication

For reliable micro frontends, shared authentication should isolate failures and keep shared state minimal. Let each team own its app end to end while agreeing on a few shared contracts.

Concern	Recommendation
Isolation	One app's crash should not break others
Shared state	Prefer shared utility modules over globals
Routing	Keep activeWhen rules explicit and non-overlapping
Deployment	Release via import-map updates per app

Common Mistakes

Skipping error handling and edge cases when wiring up shared authentication.
Leaving shared authentication untested, so regressions slip into production.
Over-engineering shared authentication before you actually need the extra flexibility.
Ignoring documentation, which makes shared authentication hard for the next developer to change.

Key Takeaways

Shared Authentication is a core part of working effectively with single-spa.
Start small and keep shared authentication focused on a single responsibility.
Apply consistent patterns so shared authentication scales across your project.
Test and document shared authentication to keep it maintainable over time.

Pro Tip

Pair shared authentication with automated tests from day one. It is far cheaper to catch single-spa regressions in CI than in production.