Design a Scalable Product Authentication Platform

Design the authentication infrastructure for a cloud product. Users log in with email and password; the design should be able to add external identity providers later. Cover the login flow, APIs, storage schema, credential protection, session lifecycle, database choice, backup and recovery, and a path to ten times the original traffic.

Constraints & Assumptions

• The system serves browser and API clients.
• Authentication establishes identity; product-specific authorization is a separate concern but must consume the identity safely.
• Passwords must never be stored reversibly.
• Clients may retry requests, sessions may be revoked, and an attacker may attempt credential stuffing.
• Availability matters, but weakening credential verification during an outage is not acceptable.

Clarifying Questions to Ask

• What login methods, regulatory constraints, and session durations are required?
• Must revocation take effect immediately across all services?
• Is multi-factor authentication required for all users or only risky actions?
• What recovery-point and recovery-time objectives apply to identity data?