Configuring Auth

You configure Auth in Studio. Each environment has its own settings, so changing development never touches production.

Open it

Choose your project and an environment (development, production…) from the top bar.
In the sidebar, under Access, choose Users & auth.
Use the secondary sidebar:

Group	Pages
People	Users, Organizations, Invitations, Roles
Sign-in	Authentication flow, Sign-in & registration, Email templates, Attributes, Social providers, Company sign-in, OAuth servers, Domains
Security	Password policy, Multi-factor, Account recovery, Devices, Sessions, Attack protection, Restrictions
Developers	Token profiles, User API keys, Auth webhooks
Records	Sign-in activity, Import & export

How saving works

A page that edits settings shows a Save bar when you have unsaved changes. Nothing is applied until you save, and Discard drops your edits. Saving a page saves that page’s settings; other pages are untouched. Changes apply to new sign-ins at once. People already signed in keep their session until it refreshes (the access token lasts 15 minutes by default).

Where each setting is

I want to…	Go to
Turn self-registration, email verification, guests, codes, links, passkeys on or off	Sign-in → Sign-in & registration
See the whole flow at a glance	Sign-in → Authentication flow
Choose what sign-up asks for	Sign-in → Attributes, Sign-in & registration
Add Google, GitHub, Apple…	Sign-in → Social providers
Connect a customer’s SAML/OIDC login	Sign-in → Company sign-in
Set where emails and sign-ins may return	Sign-in → Domains
Change the wording of emails	Sign-in → Email templates
Set password rules	Security → Password policy
Turn on two-step, require it	Security → Multi-factor
Control password resets	Security → Account recovery
Track and limit devices	Security → Devices
Set token lifetimes, sessions per person	Security → Sessions
Lock accounts after failures	Security → Attack protection
Limit who can sign up	Security → Restrictions
Issue tokens for another service	Developers → Token profiles
Let people make personal API keys	Developers → User API keys
Send auth events to your system	Developers → Auth webhooks
Back up or move users	Records → Import & export

Each page of this section follows the same screen.

Ask the project what is on

Your app can read the public part of the configuration to decide what to show:

const settings = await pawabase.auth.settings();
if (settings.passkeys_enabled) showPasskeyButton();
if (settings.magic_link_enabled) showLinkOption();
if (!settings.signup_enabled) hideSignUp();

settings = pb.auth.settings()
if settings["passkeys_enabled"]:
    show_passkey_button()

Keep environments consistent

Build and test your sign-in design in development.
Make the same changes in production, page by page, using this checklist: Domains (real site address), Sign-in & registration, Password policy, Multi-factor, Sessions, Restrictions, Social providers (production credentials), Email templates.
Keep secrets (provider client secrets, signing keys) on Studio’s Secrets page and refer to them as secret://NAME. They are per environment; production has its own values.

Differences between environments are usually deliberate: development may allow unverified emails for quick testing, production should not. See Environments.

Authentication flow

The overview screen.

Redirect URLs

The first thing to configure.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

Open it

How saving works

Where each setting is

Ask the project what is on

Keep environments consistent

Authentication flow

Redirect URLs

​Open it

​How saving works

​Where each setting is

​Ask the project what is on

​Keep environments consistent

Authentication flow

Redirect URLs

Open it

How saving works

Where each setting is

Ask the project what is on

Keep environments consistent