Frontegg

Overview

Frontegg is a developer-focused user management platform that provides pre-built authentication and user lifecycle components that product teams embed into their web applications. Rather than requiring developers to build login pages, multi-factor authentication, and user settings interfaces from scratch, Frontegg supplies hosted or self-hosted UI components that handle these flows. Its primary audience is B2B SaaS companies building multi-tenant applications where user management complexity is high.

What This Script Does

Frontegg scripts load on pages requiring authentication or user management functionality within a web application. Client-side behavior includes:

Authentication flows: The Frontegg SDK renders login, registration, and MFA screens. These may load as embedded components within the application's own pages or as redirects to Frontegg-hosted login pages. Scripts make requests to Frontegg's authentication API to validate credentials and exchange tokens.

Session token management: Frontegg manages authentication session state using cookies and/or browser local storage. Session tokens (JWTs) are stored client-side and transmitted with API requests to verify user identity. Cookie names and expiry depend on the application's configuration — session cookies expire when the browser closes, while remember-me tokens may persist for days or weeks.

Single sign-on (SSO): For applications using Frontegg's SSO feature, the SDK handles SAML or OIDC redirects to enterprise identity providers. This involves browser redirects and token exchanges with third-party identity providers configured by the operator.

Multi-factor authentication: Frontegg's MFA flows verify TOTP codes, SMS one-time passwords, or hardware keys client-side before completing authentication. Verification requests go to Frontegg's API.

User portal: Frontegg provides an embedded user settings portal where authenticated users manage their profile, security settings, and API tokens. This component makes requests to Frontegg's management API.

Consent & Compliance

GDPR and ePrivacy Directive: Frontegg's authentication cookies and session tokens are strictly necessary for providing the authenticated application service. Users cannot access the application without these mechanisms functioning. The ePrivacy Directive exempts technically necessary cookies from the consent requirement. Under GDPR, session management processing is lawful under contract performance (Article 6(1)(b)) — it is required to deliver the service the user has signed up for. Frontegg acts as a data processor; operators must have a Data Processing Agreement in place.

CCPA/CPRA: Authentication credentials and session tokens are personal information under CCPA. Processing by Frontegg as a service provider for authentication purposes does not constitute a sale or sharing of personal information.

Consent category: essential. Frontegg handles authentication and session management — functions that are technically necessary for the application to operate.

Should You Block This Without Consent?

No.

Frontegg scripts are essential to the application's authentication layer. Blocking them would prevent users from logging in, break session management, and make the application inaccessible. Authentication infrastructure is categorically exempt from consent requirements under the ePrivacy Directive's necessity exemption.