Authentication flow

Authentication flow is the first page under Users & auth → Sign-in. It shows your whole sign-in design on one screen and links to the detailed pages. Use it to understand what is currently on and to flip the common switches.

In Studio

The page has five cards.

Registration

Who may join, and what must happen before their first sign-in.

Setting	Meaning
Self-registration	Anyone may create an account. Off makes the app invitation-only
Verify email before sign-in	A new account must open the link in its confirmation email first
Guest sign-in	Let someone start with no details and become a real account later
Sign-up form	What sign-up asks for. See Sign-up form

First factor

The ways a person proves who they are when they sign in.

Setting	Meaning	Learn
Email and password	The classic	Email and password
Email sign-in link	Click a link	Sign-in links
Email one-time code	Type six digits	Email codes
Passkeys	Fingerprint, face or PIN	Passkeys
Social and company providers	Google, GitHub, SAML and more	Social, Company

Second factor

An extra step after the first factor. Two-step verification switches it on, and Requirement chooses who must use it. See Two-step verification.

Sessions

How long people stay signed in, and how many devices may stay active. Access token lifetime, Refresh token lifetime and Sessions per user. See Sessions.

Detailed controls

Shortcuts to Sign-up restrictions, Password policy and Attack protection.

Design your flow

A few combinations that work well:

App type	Suggested settings
Public consumer app	Self-registration on, verify email on, sign-in links and social on, passkeys on
Internal tool	Self-registration off, create people or invite them, company sign-in, two-step required
Marketplace with browsing first	Guest sign-in on, upgrade when they buy
B2B product	Self-registration on with allowed email domains, organizations, invitations

Read what is on and show only those options:

const s = await pawabase.auth.settings();

const options = [
  "password",
  s.magic_link_enabled && "link",
  s.email_code_enabled && "code",
  s.passkeys_enabled && "passkey",
];

Email and password

The first method to set up.

Configuring Auth

All settings in one table.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

Authentication flow

In Studio

Registration

First factor

Second factor

Sessions

Detailed controls

Design your flow

Email and password

Configuring Auth

​In Studio

​Registration

​First factor

​Second factor

​Sessions

​Detailed controls

​Design your flow

​Build your sign-in screen from the flow

Email and password

Configuring Auth

In Studio

Registration

First factor

Second factor

Sessions

Detailed controls

Design your flow

Build your sign-in screen from the flow