Abstract: Techniques are provided for authenticating a user to a server (and vice-versa) through an Instant Messaging (IM) communication channel instead of through the primary communication channel, e.g., using a web browser. User/server authentication through an IM channel may occur as part of the login process and/or before any transactions are completed. Thus, a client device sends, via the primary communication channel (e.g., using HTTP) a request for a service provided by a server. After the server receives the request, the server establishes an IM communication channel with the client device. The IM communication channel is different than the primary communication channel. Both the server and the client device execute an IM client. The server then uses the IM communication channel to authenticate a user of the client device. The server completes the request.