Choose sign-in methods and password rules

All of your project's sign-in behaviour is set in one window. Nothing changes for existing users until you save, and password rules only apply to new passwords.

Open the settings

1. Open your project and choose Authentication in the sidebar.
2. Choose Settings.
3. Switch between tabs, make your changes, then choose Save changes. A "Saved." message confirms it.

The Social login and Sender domain tabs save on their own, so they have no Save changes button.

General

• Site URL: where your app lives, for example https://app.example.com. Links in emails point here so people land in your app. Leave it empty and your users receive codes instead of links.
• Allowed redirect URLs: one per line, at most 20. Your app may ask for an email link to land on one of these. Anything not listed here, or not under your Site URL, is ignored. This stops your emails being used to send people to someone else's site.
• Allow new sign-ups: turn this off to stop creating accounts. Existing users can still sign in.
• Let users delete their own account: deleting needs their password or a recent sign-in.
• Require a verified email before password sign-in: choose Use the platform default, Required or Not required. When it is required, new accounts get no session until they confirm their address, and unverified users cannot sign in.

URLs must be complete (https://...), must not include a username, password or #fragment, and must use https. Plain http is only accepted for localhost.

Sign-in methods

Choose how people can sign in with their email:

• Email and password
• One-time code: a 6-digit code emailed to the user. It is also used to finish a passwordless sign-up.
• Magic link: a single-use link or token emailed to the user.

At least one method has to stay on. Social login is set up in its own tab.

Passwords

• Minimum length: between 6 and 128 characters (the default is 8).
• Require an uppercase letter, Require a number, Require a symbol.

Sessions

• Access token lifetime (minutes): between 5 and 1440 (the default is 60). Shorter is safer, because apps renew silently with the refresh token.
• Refresh token lifetime (days): between 1 and 90 (the default is 30). This is how long someone stays signed in without entering credentials again. It applies to new sign-ins.

Check your changes

Open Auth Playground and run Sign up and Sign in with a throwaway address. If a rule rejects the attempt, the message tells you which rule it was.

Good to know

• Signing a user out everywhere, or changing their password, ends every session they have open.
• One-time codes expire after 10 minutes. Magic links and password reset links expire after one hour.
• Your app can read which methods are on, and the password rules, from the project's settings so that its sign-in form matches. See Use the TypeScript SDK.