| description | This module provides a user login/logout system as well as administrative utilities for managing a site's users. |
|---|
Auth owns users, groups, sessions, and everything about signing in and out. It provides password login, registration, password reset, and the admin screens for managing accounts.
| Method | Notes |
|---|---|
| Password | Email or username, depending on APP_NATIVE_LOGIN_USING |
| Passkeys | WebAuthn; enable with AUTH_PASSKEYS_ENABLED. A fingerprint, face, screen lock, or security key instead of a password |
For a second step after password login, see Multi-Factor Auth. A user-verified passkey login satisfies that second step on its own.
Failed logins are counted per user. After five, the account is locked out for five minutes, and every attempt is delayed briefly to make guessing expensive. A captcha can be required on the login, registration, and password reset forms under Settings → Authentication.
Auth ships several cleanup routines. See Housekeeping.