System design interview question
Design a Distributed Session Management and Authentication System like OAuth 2.0 Provider at Scale
Design a highly available, distributed session management and authentication system that handles login/logout, token issuance, and validation for a global platform serving 500M users across multiple regions. The system must support 50K concurrent login requests per second during peak hours, issue short-lived access tokens (15 minutes) and long-lived refresh tokens (30 days), and validate session tokens with sub-100ms latency globally. Key requirements include preventing token replay attacks, handling cross-region session consistency, managing token revocation at scale, supporting multiple authentication methods (password, OAuth, MFA), and gracefully degrading when backend services experience partial outages. The system must maintain 99.99% availability while managing billions of active sessions concurrently.
Practice this question step by step with an AI interviewer that reviews your requirements, your architecture and your trade-offs, and scores the design.