Passwordless authentication

Passwordless authentication is a type of authentication that does not require end-users to set or maintain passwords for access to an application. Instead, they authenticate using a one-time passcode (OTP).

The email + passwordless method is switched on by default in all new Kinde businesses

About one-time passcodes (OTPs)

Link to this section

Kinde does not support magic links as a password alternative, instead, we prefer to use one-time passcodes (OTPs) as they are more secure, and require manual entry as opposed to a single click.

For example, someone with access to your email could click a link to get instant access to an application, but they cannot use the code unless they have initiated the correct sign in flow and have your sign-in identity as well. If you receive the OTP via SMS, someone would need to have your device and unlock code, to access it.

A OTP can be issued via email or phone, depending how you have set up authentication. It is also common to use OTPs as a factor in multi-factor authentication.

Passcodes issued from Kinde expire after 2 hours.

Set up passwordless authentication

Link to this section

1. In Kinde, go to Settings > Environment > Authentication.

2. In the Passwordless section, select Configure on one of the relevant tiles:

   • Email connections > Code
   • Phone connections > Code
   • Username connections > Code

3. Select which applications will use this authentication method.

4. Select Save.

   About phone authentication

   Kinde’s default SMS service works in live environments. On the Free plan it is limited to 10 SMS per month. On paid plans it is not capped — see Kinde pricing. Connecting your own provider (Twilio or Sinch Engage) is recommended for deliverability and is a paid-plan feature. Learn more.

Offer a code to password users

Link to this section

You do not have to choose between passwords and passcodes for every user. If your app uses Email + password or Username authentication, you can add a Sign in with a code button to the password page. Users who select it get a one-time passcode by email and sign in without their password, while everyone else continues to use their password as normal.

This is set per connection, in the password connection’s configuration. See Use password and passwordless auth at the same time.

If a user does not receive a code

Link to this section

It should not happen often, but occasionally users do not receive their passcode. Here’s a few suggestions.

• Tell the user to check their junk folder - some email providers, systems, and devices have security in place to prevent spam. An OTP from an unknown provider (like Kinde) might get accidentally treated as such.
• Once or twice we have come across a domain provider who has added Kinde to a denylist and OTPs from us get rejected. You’ll need to contact us so we can investigate and arrange allowlisting. This is a very rare cause of failed OTPs.
• If the user reached the code screen from the Sign in with a code button on the password page, check that they have a verified email address on their profile. Without one, Kinde shows the code screen but does not send a code.

Attack protection settings

Link to this section

Kinde allows you to control the number of sign-in attempts a user gets, how long they get locked out after a failed sign-in attempt, etc. See Attack protection.