Configure authentication
Bu içerik henüz dilinizde mevcut değil.
Configure the sign-in methods for your instance. Choose simple or full mode first; full mode is required for SSO.
Prerequisites
Section titled “Prerequisites”- A working installation with persistent account storage.
- Deployment keys and outbound email.
- Administrative access to change the application’s startup configuration.
1. Confirm the mode and account settings
Section titled “1. Confirm the mode and account settings”For a new deployment using full authentication, supply:
AUTHENTICATION_MODE=fullAUTH_ENABLED=trueDo not switch an existing simple-mode installation to full mode as an account migration shortcut: the modes use different account stores.
AUTH_SIGNIN and AUTH_SIGNUP control password and email-link sign-in and self-service signup. They do not apply to SSO: with AUTH_SIGNUP=false, a first SSO sign-in still creates an account. To limit which email addresses can create accounts by any method, set ALLOWED_SIGNUP_DOMAIN to a comma-separated list of domains; the same check applies to account creation through SSO.
Custom domains also have their own settings, so verify the result on each public hostname you operate. Turning authentication off does not make the service private; network access and anonymous secret sharing are separate controls.
2. Enable the required sign-in methods
Section titled “2. Enable the required sign-in methods”Full mode offers optional SSO, email-link sign-in and passkeys. Set only the features you intend to use; the environment reference lists their prerequisites.
For SSO, see Single sign-on. For email-link sign-in, configure delivery before enabling AUTH_EMAIL_AUTH_ENABLED=true.
3. Apply restrictions after testing
Section titled “3. Apply restrictions after testing”Leave the AUTH_*_ONLY flags unset while setting up a new method. Once it works, choose at most one restriction: AUTH_PASSWORD_ONLY, AUTH_EMAIL_AUTH_ONLY, AUTH_WEBAUTHN_ONLY or AUTH_SSO_ONLY.
In full mode, conflicting flags or a restriction whose required method is unavailable cause a startup error. These restrictions enforce access to authentication routes; they are more than button visibility settings. A restricted method that becomes unavailable after startup does not automatically restore other methods.
Verify it worked
Section titled “Verify it worked”Restart the deployment, inspect startup errors, and test in a private browser window. Check an allowed sign-in, a disallowed method if you restricted methods, and the intended signup behavior. Repeat on each custom domain rather than assuming the canonical hostname’s result applies everywhere.
Keep access to deployment configuration so you can restore the previous settings if sign-in fails.