Use password and passwordless auth at the same time

You can let users choose a password or a one-time passcode (OTP) in the same sign-in flow. This is useful when a user has forgotten their password but does not want to reset it, or when you want to reduce password friction without moving the app fully to passwordless. To do this:

1. Enable a password connection (Email or Username)
2. Go to the password connection settings and enable code option

Enable both password and passwordless auth

Link to this section

Enable a password connection first, then turn on the code option on that connection. Use one or both of these connections for your application:

• Email + password
• Username + password

1. Enable password connections

Link to this section

Skip this step if you already have a password connection enabled for your application.

1. Sign in to your Kinde dashboard.

2. Select View details on the relevant application, or go to Settings > Environment > Applications and select View details.

3. Select the Authentication menu.

4. Enable one or both of the password connections for the app (Email connections > Password or Username connections > Password).

   

2. Turn on ‘Sign in with a code’ option

Link to this section

Now, to also enable a passwordless one-time passcode alongside the password connection, do the following:

1. In Kinde, go to Settings > Environment > Authentication.

2. In the Password section, select Configure on the relevant tile: Email connections > Password or Username connections > Password. A configuration window opens.

3. In the Settings section, switch on Show ‘Sign in with a code’ on password page.

   

4. Select Save.

Repeat for the other password connection if you want the option on both.

This setting is not application-specific

The setting lives on the connection, not on the application. If several applications share the Email + password or Username + password connection, switching this on affects all of them.

Some connection options are properties of the connection itself rather than of the organization. If an organization uses a shared password connection, the option follows whatever is set on that shared connection. You cannot switch it on for one organization and off for another while both use the same connection. See Set custom authentication per organization.

Button appearance

Link to this section

End-user experience

Link to this section

When the option is switched on, the user sees an Or separator and a Sign in with a code button below the password field during sign-in.

The user can choose to sign in with either their password or a one-time passcode.

The user's password remains unchanged

When the user signs in with a one-time passcode, their password is not changed or removed. They can continue to sign in with their password the next time.

Customize the labels

Link to this section

You can change the wording of both the separator and the button.

1. In Kinde, go to Design > Page content.

2. Select the Verify password page from the dropdown menu.

3. Scroll down and edit the following fields:

   • Authentication method separator (default: Or)
   • Login with code button label (default: Sign in with a code)

   

4. Select Save.

Changes take effect immediately. You do not need to redeploy your application.

The next time a user opens the sign-in page, they see the updated labels:

See Update page content.

Feature details and limitations

Link to this section

Where Kinde sends the code

Link to this section

Sign-in identity	Where Kinde sends the code
Email + password	The email address the user entered to sign in
Username	The verified email address on the user’s Kinde profile

Kinde only ever sends the code to an email address that is already verified on the account. It never sends the code to an address supplied in the sign-in request, such as through login_hint.

The passcode behaves exactly like any other Kinde one-time passcode. It expires after 2 hours, and attack protection limits on sign-in attempts still apply. See Passwordless authentication for more about how Kinde issues codes.

When the option is not offered

Link to this section

The Sign in with a code button is hidden and the code flow is refused in these cases:

• The user has a temporary password to enter. They must use the temporary password and set their own password first. This applies even if an admin sets the temporary password after the sign-in page has already loaded.
• The connection setting is off. The option only appears for connections where you switched it on.

Users without a verified email

Link to this section

A user needs a verified email address to receive a code. If they do not have one, Kinde still shows the code entry screen but does not send a code. The user cannot complete sign-in this way and should use their password.

This is intentional. Showing the same screen regardless of whether an account exists or has a verified email means an attacker cannot use the button to determine which accounts are real. It is the same protection described under attack protection. If a user reports that no code arrived, check that they have a verified email identity on their profile. See Identity and verification.

Multi-factor authentication

Link to this section

Signing in with a code does not skip any other step in your sign-in flow. If the user is required to complete multi-factor authentication, select an organization, or complete a required profile step, they are still prompted after entering the code.