# Basic Concepts: Client-side authentication, server-side validation **URL:** \ **Category:** Get Help\ **Created:** [April 4, 2022, 1:05pm UTC](https://community.auth0.com/t/basic-concepts-client-side-authentication-server-side-validation/81060 "2022-04-04T13:05:04Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![komali2](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/komali2/32/36364_2.png) [@komali2](https://community.auth0.com/u/komali2)\ **Post date:** [April 4, 2022, 1:05pm UTC](https://community.auth0.com/t/basic-concepts-client-side-authentication-server-side-validation/81060/1 "2022-04-04T13:05:05Z")
So, new to auth0 here, and we’re trying to work out basic concepts here. We have a react UI, and it seems like we can just manage authentication by communicating directly from it with auth0: [Auth0 React SDK Quickstarts: Login](https://auth0.com/docs/quickstart/spa/react) However, we have a backend API (python/django) with which we need to make authenticated requests (database queries and the like) based on a given user’s permissions. We’re not quite sure what kind of model we should be following here: Do we have the backend manage auth0 through the django SDK? And then somehow authenticate the frontend with tokens? If we have the frontend communicate directly with the auth0 api, how do we inform the backend of new user creations, and how do do user management between our frontend and our backend? ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [April 5, 2022, 11:44pm UTC](https://community.auth0.com/t/basic-concepts-client-side-authentication-server-side-validation/81060/3 "2022-04-05T23:44:03Z")
Hi there @komali2 welcome to the community! > [@komali2](#): > > We’re not quite sure what kind of model we should be following here: Do we have the backend manage auth0 through the django SDK? And then somehow authenticate the frontend with tokens? I definitely recommend first checking out [this page](https://auth0.com/docs/get-started/architecture-scenarios/spa-api) which outlines the SPA + API architectural scenario. This should provide you a high level overview of the concepts involved. Essentially, your frontend will handle authenticating a user and obtaining tokens (ID/Access tokens) whereas your backend will be responsible for validating those tokens and making decisions based on the scopes/permissions granted. For an even higher level overview of Identity fundamentals, [this video series](https://auth0.com/docs/videos/learn-identity-series) can be super helpful - I revisit it often! 😄 We do also have a Python/Django sample that may be worth looking into - You can find that [here](https://auth0.com/docs/quickstart/backend/django/01-authorization). Hope this helps get you started in the right direction! ---
**Author:** ![komali2](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/komali2/32/36364_2.png) [@komali2](https://community.auth0.com/u/komali2)\ **Post date:** [April 6, 2022, 3:45am UTC](https://community.auth0.com/t/basic-concepts-client-side-authentication-server-side-validation/81060/4 "2022-04-06T03:45:12Z")
Thank you, that documentation was super helpful and really well written. One thing we’re confused about is how we can just use auth0 as… Is the term identity provider? Basically we have a massively complex permissions use case that we wanna manage on our database with Django models etc. We’re wondering how we can use auth0 to basically validate, say, a Google account, and then identify that against a user account in our database (or register that in our database). It seems to use the frontend SDK for this would involve doing all the verification on the frontend, then sending Identity information to the backend to verify again / register? ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [April 22, 2022, 11:11pm UTC](https://community.auth0.com/t/basic-concepts-client-side-authentication-server-side-validation/81060/5 "2022-04-22T23:11:26Z")
Hey @komali2! Sorry for the delay here, but wanted to see if you made any further progress on this. > [@komali2](#): > > We’re wondering how we can use auth0 to basically validate, say, a Google account, and then identify that against a user account in our database (or register that in our database). This sounds like you may want to use a [social connection](https://marketplace.auth0.com/features/social-connections?_ga=2.125433805.611964105.1650304587-645277782.1648681205&_gl=1*19y317c*rollup_ga*NjQ1Mjc3NzgyLjE2NDg2ODEyMDU.*rollup_ga_F1G3E656YZ*MTY1MDY2Mjk3MS41MS4xLjE2NTA2Njg4ODcuNjA.) against your Auth0 tenant - Basically, you can allow users to authenticate with a social identity provider (in this case google) and then Auth0 will have store information about that in the [user’s details](https://auth0.com/docs/api/management/v2#!/Users/get_users_by_id), in particular the `identities` array. You can also access similar information via the `event` [object](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/event-object) available in actions. Some more on Identity Provider Access Tokens: > **[Identity Provider Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens/identity-provider-access-tokens)** > > Understand third-party access tokens issued by identity providers after user authentication and how to use them to call the third-party APIs. Hope this helps! ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [May 25, 2022, 11:30pm UTC](https://community.auth0.com/t/basic-concepts-client-side-authentication-server-side-validation/81060/6 "2022-05-25T23:30:20Z")