Authentication
Configure sign-in methods, two-factor authentication, and social login for users of your authentication collection.
Go to Studio → Collections → select an auth collection → Options → Authentication.
Authentication options are grouped into methods on the AUTH METHODS rail. Click a method to open its configuration panel.
Password
Users authenticate with a password stored in a password-typed field on their record. This method is on by default.
Set which fields hold the credentials:
| Setting | Description |
|---|---|
| Username field | The field used as the login identifier (usually email or username). Only fields marked Required can be selected. |
| Password field | The password-type field that stores the password. |
Set up password rotation for onboarding or security:
| Setting | Description |
|---|---|
| Force change on next login | Require a password reset on the next sign-in. |
| Must-change-password field | The boolean field that triggers a reset. Turning on force-change lets you pick this column. |
Passwordless
Let users sign in with a magic link or one-time code. Click the toggle on the Passwordless header to turn it on, then set up one or both methods.
Magic link
Sends a sign-in link that logs the user in when clicked.
| Setting | Description |
|---|---|
| Delivery channel | Email, SMS, or WhatsApp. |
| Email field / Phone field | The field holding the recipient's contact information. |
| Expiry (min) | How many minutes the sign-in link stays valid. |
One-time password (OTP)
Sends a numeric code that the user enters on the sign-in page.
| Setting | Description |
|---|---|
| Delivery channel | Email, SMS, or WhatsApp. |
| Email field / Phone field | The field holding the recipient's contact information. |
| Code length | The number of digits in the generated code (default 6). |
| Expiry (min) | How many minutes the code stays valid. |
Two-Factor
Add a second verification step. Click the toggle on the Two-Factor Authentication header to turn it on.
Set who must use two-factor authentication:
| Setting | Description |
|---|---|
| Restrict to specific roles | Limit the requirement to certain roles. |
| Allowed roles | The roles required to use two-factor authentication. |
| Minimum methods required | How many verification methods a user must configure. |
Turn on the verification methods to make available:
| Method | Description |
|---|---|
| Authenticator App (TOTP) | Users scan a QR code with an authenticator app (such as Google Authenticator or 1Password) to generate codes. |
| Sends a code to the user's email address. Select the email field. | |
| SMS | Sends a code to the user's phone number. Select the phone field. |
| Backup Codes | Single-use recovery codes users can download to sign in if they lose their primary method. |
Social Login
Let users sign in with third-party accounts. Click the toggle on the Social Login header to turn it on, then configure each provider you want to support: Google, Microsoft, or GitHub.
Provide the OAuth credentials from the provider's developer console:
| Setting | Description |
|---|---|
| Client ID | The application identifier from the provider. |
| Client secret | The secret key that authenticates your application with the provider. |
| Tenant | (Microsoft only) The Azure AD tenant, or common for multi-tenant applications. |
| Redirect URI | The URL the provider redirects to after sign-in (for example, https://your-app.example.com/auth/callback). |
| Scopes | The OAuth permissions to request when the user signs in. |
Related
- Roles — Define roles and access conditions
- Register Form — Configure registration forms
- Profile & Session — Configure profile views
- Auth Collections Overview — Back to auth collections overview