Sign-in methods

Email & password, email one-time codes — and what is coming later.

Email & password

Sign-up takes an email and a password of at least 8 characters that does not contain the email's local part. Passwords are hashed with argon2id (bcrypt where argon2 is unavailable) and are never stored, logged or returned in any form.

Sign-in answers identically for "no such user", "wrong password" and "account disabled" — one failure, one message.

Email one-time codes

Passwordless: request a code, then redeem it. A six-digit code from a CSPRNG, valid ten minutes, single-use, five attempts before it burns. Requesting a new code retires the previous one, so exactly one is ever live per user.

POST /v1/projects/{project}/auth/otp/request   {email}
// → { sent: true }   — the same answer whether or not the address exists

POST /v1/projects/{project}/auth/otp/redeem    {email, code}
// → { user, access_token, refresh_token }

An OTP request creates the account on first use — passwordless applications have no other moment to create one. Redeeming a code proves the inbox, so it also marks the email verified.

Sign-in methods: what is on, and what is honestly not built yet.

Turning methods on and off

Auth → Sign-in methods toggles each. A disabled method's endpoints answer 404 — the method is absent, not merely discouraged.

Coming later

Google, Microsoft, Apple, GitHub, generic OIDC and enterprise SAML are planned. The console lists them under Coming later with no switches, because they are not built. When one ships it will appear as a real toggle and this page will document it.