Sign-in & auth controls how users enter the platform: sign-in and registration methods, email verification, Turnstile human verification, OIDC / OAuth2 identity providers, and sign-in security policy.

Where to find it#

Open Admin console → Sign-in & auth. The page is split into five groups, and each group has its own Save button:

• Sign-in page
• Sign-in & registration
• Human verification
• Binding & verification
• Sign-in security

The OIDC / OAuth2 identity providers table appears inside Sign-in & registration when Third-party login is on.

Changes take effect on the next sign-in or registration attempt. Make sure at least one administrator can still sign in before you disable a method.

Control sign-in and registration methods#

1. Open Sign-in & registration.
2. Switch the methods you want.
3. Click Save.

The switches depend on each other:

• Email registration can be on only when Email login is on. Turning Email login off also turns off Email registration and Registration human check.
• Password reset can be on only when Email verification is on. Turning Email verification off also turns off Password reset.
• You cannot turn off both Username login and Email login unless Third-party login is on and an administrator has a linked identity provider. Otherwise the switch is rejected with Cannot disable sign-in method.

Set the default redirect path#

1. Open Sign-in page.
2. Enter a path in Default redirect path.
3. Click Save.

The value is used when a user opens /login without a next parameter. It must be an internal path that starts with a single /, for example /chat. A value such as https://example.com or //example.com is rejected with The default redirect path must be an internal path, for example /chat.

Configure email verification and SMTP#

1. Open Binding & verification.
2. Turn on Email verification. The SMTP fields appear.
3. Fill in SMTP host, SMTP port, SMTP username, and SMTP password.
4. Optionally set Sender.
5. Click Save.

While Email verification is on, saving fails if any required SMTP field is empty, or if the port is out of range:

• Email verification requires SMTP host, SMTP port, SMTP username, SMTP password.
• SMTP port must be an integer between 1 and 65535.

Registration email policy#

Enable human verification#

Registration human verification uses Cloudflare Turnstile. It applies only to email registration; OIDC / OAuth2 sign-in is not affected.

1. Turn on Email registration and save it first.
2. Open Human verification.
3. Turn on Registration human check.
4. Enter the Turnstile Site Key and Turnstile Secret Key.
5. Click Save.

The Secret Key is hidden after saving; leave it empty to keep the stored value. Saving fails when the prerequisites are not met:

• Enable email registration before enabling Turnstile verification.
• Turnstile verification requires Turnstile Site Key, Turnstile Secret Key.

Account and password rules#

These rules are enforced by the platform when a user registers, resets a password, or an administrator creates an account. They are not editable on this page.

Add an OIDC / OAuth2 identity provider#

1. In Sign-in & registration, turn on Third-party login and click Save.
2. Click Add identity provider.
3. Pick a preset (Apple, GitHub, Google, Discord, Facebook, Hugging Face, Linux Do, Microsoft, Twitter (X), Vercel) or Custom OIDC / Custom OAuth2.
4. Fill in the fields and, for OIDC, choose Issuer URL or Discovery URL.
5. Copy the callback URL and paste it into the provider's console.
6. Set Scopes and, if needed, the field mapping under Advanced settings.
7. Click Save.

Callback URL#

The dialog shows the callback URL that the provider must allow. When the platform exposes a server callback bridge, the primary field is Server callback URL (recommended) in the form <base>/<provider-slug>/callback, and a Legacy Web callback URL (deprecated soon) in the form <origin>/auth/callback?provider=<provider-slug> is also shown. Otherwise only the legacy URL is shown, labeled Callback URL. Use Copy URL to copy it.

Provider fields#

Manage providers#

The provider table lists Name, Type, Sign-in, Registration, and Client ID.

• Toggle Sign-in and Registration directly in the table. Registration cannot be turned on unless Sign-in is on; otherwise you see Enable sign-in first.
• Drag the handle to reorder providers. The order is saved automatically.
• Click a provider name or the pencil icon to edit it. Click the trash icon to delete it.
• Deleting a provider unlinks all accounts that use it. If some accounts rely only on that provider, the platform shows Force delete identity provider. After a force delete, those accounts can no longer sign in through it. Confirm those users have a password or another provider first.

Set sign-in security#

1. Open Sign-in security.
2. Set the values you need.
3. Click Save.

Review security events#

Sign-in, two-factor, password, and other security events are recorded in the admin logs.

1. Open Admin console → Logs.
2. Select the Auth security tab.
3. Use the search box, the Result filter, and the sort menu to narrow the list.
4. Click a row to open Auth log detail.

Search matches user ID or event type. Sorting supports occurred time (newest or oldest) and ID (newest or oldest). The Clean up logs action can delete auth security history by cutoff date; active sessions and credentials are not changed.

Setting key reference#

All keys belong to the auth namespace.

OIDC / OAuth2 providers are stored as individual provider records, not as auth.* keys. Each record carries its own login and registration control.

Troubleshooting#

• Save fails with a redirect path error. The value must be an internal path such as /chat. Remove the scheme and host.
• A login method switch is rejected. Third-party-only sign-in requires an administrator with a linked identity provider. Link one first, then disable username and email login.
• Email verification will not save. Fill in SMTP host, port, username, and password, and use a port between 1 and 65535.
• Turnstile will not save. Turn on Email registration first, then fill in both the Site Key and Secret Key.
• Third-party sign-in redirects back with an error. The callback URL registered at the provider must match the URL shown in the provider dialog exactly, including the slug.
• Session expired toast while saving. Sign in again; the admin session ended before the change was written.

Related#

• Accounts
• Logs
• Account
• Permission groups