---
title: Build a Custom Authentication System in Access Server
canonical: https://openvpn.net/as-docs/custom-authentication-system/
product: Access Server Docs
---

# Build a Custom Authentication System in Access Server

Access Server’s post-auth script (PAS) supports setting up a custom authentication method. Using a PAS in Python3 language, you can extend Access Server’s built-in authentication methods. For example, it can supplement the built-in authentication systems with a custom MFA.

- [Tutorial: Create a Custom Authentication System with a Python Script](https://openvpn.net/as-docs/tutorials/tutorial--custom-authentication-system.md)

> **Warning**
>
> PAS-only authentication aims to allow the administrator of the Access Server to implement a completely custom authentication system. That means responsibility for handling the authentication is shifted out of Access Server and into the post-auth script. It is up to the creator/maintainer of this script to ensure that it is safe to use. It is important to understand that with the use of PAS-only, any authentication problems are no longer the responsibility of the Access Server program.

---

Prev: [Challenge/Response](https://openvpn.net/as-docs/challenge-response.md)
Next: [Authorization & Access Control](https://openvpn.net/as-docs/authorization---access-control.md)
Index: https://openvpn.net/as-docs/llms.txt