How govuk-one-login/authentication-api works
This repository implements backend authentication and orchestration for GOV.UK One Login. Its broad user-facing surface includes frontend authentication journeys, token and user-info endpoints, account management, passkeys/account data, delivery callbacks and audit events. A typical journey enters the frontend API and uses shared session, code and MFA services before producing authentication results; separate branches manage accounts and credentials. Most implementation files were not sampled, so runtime links beyond the explicitly documented frontend integrations are shown as unverified dashed edges.
Main entry points: frontendapi Frontend API · accountmanagement Account management · external External API · accountdata Account data API
Components 20
Authentication journeys
- Frontend API
frontend-api/src/main/java/uk/gov/di/authentication/frontendapi
Account services
- Account management
account-management-api/src/main/java/uk/gov/di/accountmanagement - Account deletion
account-management-api/src/main/java/uk/gov/di/accountmanagement/services/AccountDeletionService.java
Credential data
- Account data API
account-data-api/src/main/java/uk/gov/di/authentication/accountdata - Passkey operations
account-data-api/src/main/java/uk/gov/di/authentication/accountdata/services/PasskeysService.java - Passkey storage
account-data-api/src/main/java/uk/gov/di/authentication/accountdata/services/DynamoPasskeyService.java
External interfaces
- External API
auth-external-api/src/main/java/uk/gov/di/authentication/external - Token service
auth-external-api/src/main/java/uk/gov/di/authentication/external/services/TokenService.java - User info
auth-external-api/src/main/java/uk/gov/di/authentication/external/services/UserInfoService.java - Delivery receipts
delivery-receipts-api/src/main/java/uk/gov/di/authentication/deliveryreceiptsapi/lambda/NotifyCallbackHandler.java
Shared runtime
- Auth sessions
shared/src/main/java/uk/gov/di/authentication/shared/services/AuthSessionService.java - Code storage
shared/src/main/java/uk/gov/di/authentication/shared/services/CodeStorageService.java - MFA methods
shared/src/main/java/uk/gov/di/authentication/shared/services/mfa/MFAMethodsService.java - Audit events
audit-events/src/main/java/uk/gov/di/authentication/auditevents/services/StructuredAuditService.java - Identity models
shared/src/main/java/uk/gov/di/authentication/shared/entity/UserProfile.java - Runtime configuration
shared/src/main/java/uk/gov/di/authentication/shared/services/ConfigurationService.java
Other components
- User or client
- TICF CRI
- Account interventions
- IPV service
Connections 19
- User or client → Frontend API: starts journey
- Frontend API → Auth sessions: uses sessions
- Frontend API → Code storage: uses codes
- Frontend API → MFA methods: manages MFA
- Frontend API → TICF CRI: requests service
README.md - Frontend API → Account interventions: requests service
README.md - Frontend API → IPV service: requests service
README.md - External API → Token service: handles tokens
- External API → User info: serves user info
auth-external-api/src/main/java/uk/gov/di/authentication/external/services/UserInfoService.java - Account management → Account deletion: deletes accounts
account-management-api/src/main/java/uk/gov/di/accountmanagement/services/AccountDeletionService.java - Account data API → Passkey operations: manages passkeys
account-data-api/src/main/java/uk/gov/di/authentication/accountdata/lambda/PasskeysRetrieveHandler.java - Passkey operations → Passkey storage: stores passkeys
account-data-api/src/main/java/uk/gov/di/authentication/accountdata/services/PasskeysService.java - Account management → Account data API: proxies passkeys
- Frontend API → Audit events: records events
frontend-api/src/main/java/uk/gov/di/authentication/frontendapi/services/webauthn/PasskeyAssertionService.java - Account management → Audit events: records events
account-management-api/src/main/java/uk/gov/di/accountmanagement/services/AccountDeletionService.java - Delivery receipts → User or client: receives callback
- Auth sessions → Identity models: stores session data
- Frontend API → Identity models: uses identity data
- Runtime configuration → Frontend API: configures runtime
frontend-api/src/main/java/uk/gov/di/authentication/frontendapi/services/AMCService.java