An authentication system comprises a brain-computer interface (BCI) configured for detecting neural activity in a brain of a subject in response to the subject performing a repeatable mental task, and outputting neural data representative of the detected neural activity. The authentication system further comprises a computer configured for acquiring the neural data output by the BCI while the subject is performing the repeatable mental task, and generating an authorization request containing the neural data. The authentication system further comprises an authentication processor configured for acquiring the authorization request containing the neural data from the computer, authenticating the subject based on the acquired authorization request, and sending an authorization token to the computer.