An authentication system includes first and second terminals, and an authentication subsystem. The authentication subsystem: generates a first token based on reception of a code image authentication start request, generates and stores a code image key in association with the first token, generates and stores a code image including the code image key at a URL of the storage unit, transmits the first token and the URL to the first terminal, registers the received first token as a key in an information transmitting and receiving unit, checks whether a received ID of the second terminal is a unique ID, when the received unique ID of the second terminal is the unique ID, checks whether the received code image key is stored in the storage unit, and transmits a first response code to the information transmitting and receiving unit using, as a key.