Manage the authentication experience
Auth and access
Passwordless authentication
Passwordless authentication is a type of authentication that does not require end-users to set or maintain passwords for access to an application. Instead, they authenticate using a one-time passcode (OTP).
About one-time passcodes (OTPs)
Link to this sectionKinde does not support magic links as a password alternative, instead, we prefer to use one-time passcodes (OTPs) as they are more secure, and require manual entry as opposed to a single click.
For example, someone with access to your email could click a link to get instant access to an application, but they cannot use the code unless they have initiated the correct sign in flow and have your sign-in identity as well. If you receive the OTP via SMS, someone would need to have your device and unlock code, to access it.
A OTP can be issued via email or phone, depending how you have set up authentication. It is also common to use OTPs as a factor in multi-factor authentication.
Passcodes issued from Kinde expire after 2 hours.
Set up passwordless authentication
Link to this section-
In Kinde, go to Settings > Environment > Authentication.
-
In the Passwordless section, select Configure on one of the relevant tiles:
- Email connections > Code
- Phone connections > Code
- Username connections > Code
-
Select which applications will use this authentication method.
-
Select Save.
Offer a code to password users
Link to this sectionYou do not have to choose between passwords and passcodes for every user. If your app uses Email + password or Username authentication, you can add a Sign in with a code button to the password page. Users who select it get a one-time passcode by email and sign in without their password, while everyone else continues to use their password as normal.
This is set per connection, in the password connection’s configuration. See Use password and passwordless auth at the same time.
If a user does not receive a code
Link to this sectionIt should not happen often, but occasionally users do not receive their passcode. Here’s a few suggestions.
- Tell the user to check their junk folder - some email providers, systems, and devices have security in place to prevent spam. An OTP from an unknown provider (like Kinde) might get accidentally treated as such.
- Once or twice we have come across a domain provider who has added Kinde to a denylist and OTPs from us get rejected. You’ll need to contact us so we can investigate and arrange allowlisting. This is a very rare cause of failed OTPs.
- If the user reached the code screen from the Sign in with a code button on the password page, check that they have a verified email address on their profile. Without one, Kinde shows the code screen but does not send a code.
Attack protection settings
Link to this sectionKinde allows you to control the number of sign-in attempts a user gets, how long they get locked out after a failed sign-in attempt, etc. See Attack protection.