Introduction & Requirements
Most apps and services need a login system to reliably identify users and associate their data, access, and history with a single account over time.
This page explains what a login system needs to do, what legal requirements apply in China, which solutions are available, and what to confirm before choosing one.
Before beginning any implementation work on your login solution, confirm your plan with the AppInChina team first. This gives us time to align on account setup, compliance requirements, pricing, and any platform-specific considerations. Reaching out early avoids rework.
What a login system needs to do
A login system is not just a sign-in screen. It is the foundation for everything that ties a user to their account over time.
At minimum, a login system needs to:
- Allow users to create an account
- Allow returning users to authenticate and regain access to the same account
- Allow users to recover access if they lose their credentials
- Maintain a stable user identity that persists across sessions and devices
- Manage sessions or tokens so users stay signed in reliably
These are baseline requirements regardless of which solution is used.
The stable internal user ID
Every user should be represented by a stable internal user ID in the application's own database. This ID should not change over time, should not be editable by the user, and should not be derived from a device identifier or external provider identifier.
The stable internal user ID is what the application should use for customer records, permissions, order history, entitlements, and any data tied to the user. External identifiers from login providers should be linked to this internal ID, not used in place of it.
Legal requirement: real-name authentication
If the application includes any social or interactive features — such as posting content, commenting, messaging, or uploading media — Chinese law requires real-name authentication before users can access those features.
In practice, this means verifying the user's identity through a Chinese mobile phone number at registration or before enabling social features. All Chinese mobile phone numbers are tied to a national ID card, which satisfies this requirement.
Email-only registration is not sufficient for applications with user-generated content.
If this applies to your application, it should be confirmed as a requirement before choosing a login solution.
Choosing a login solution
The right solution depends on the application's requirements, the team's capacity, and the infrastructure already in place.
| Solution | Consider this when | Main trade-off |
|---|---|---|
| Authing | You want a managed identity platform with low implementation overhead | Vendor dependency |
| WeChat Login | Users are WeChat-native and you want a China-local login method | Needs backend integration; does not replace a full identity system |
| China cloud identity (CIAM/IDaaS) | Your infrastructure is on Alibaba Cloud or Tencent Cloud and you want a China-first managed identity platform | Tighter cloud vendor coupling |
| Custom backend login | You have a backend team and specific requirements a managed platform cannot meet | Highest engineering and security maintenance burden |
For most clients starting from scratch, Authing is the recommended default. It covers the baseline requirements with low implementation overhead and includes an admin console for user management.
Questions to confirm before choosing a solution
Before selecting a login solution, the following questions should be confirmed:
-
What login methods are required — password, SMS OTP, WeChat Login, or others?
-
Does the application include social or interactive features that require real-name authentication?
-
Should user registration be open, or should users be pre-approved before accessing the service?
-
Does the application need customer accounts, organizations, roles, or permissions?
-
Who can approve, suspend, or remove users?
-
Is there a backend team available to integrate the login system?
-
Does the application need to link multiple login methods to a single user identity?
-
Is there an existing backend or user database the login system needs to integrate with?
-
Is the application hosted on Alibaba Cloud, Tencent Cloud, AWS China, or another platform?
-
Does the application serve users outside Mainland China, and if so, how will login work across regions?
What AppInChina can help with
Depending on the project scope, AppInChina can help clients understand:
- Which login solution is most appropriate for the application's requirements
- What compliance or legal requirements apply
- What account setup or platform configuration is needed
- What work is required from the client's backend, mobile, or web teams
- How the login solution fits into the broader China launch or localization plan
- What risks or limitations should be considered before implementation