Each project has its own user directory. Users are stored in your database in auth.users, and every signed-in request carries a JWT your policies can use.
Sign up and sign in
E-mail and password accounts and e-mail confirmation.
Magic links and codes
Passwordless sign-in by e-mail.
OAuth providers
Google, GitHub, Apple and 16 more.
Multi-factor auth
Authenticator apps (TOTP) and aal2.
Sessions and tokens
Access tokens, refresh and sign-out.
Manage users
Studio and the admin API.
#Sign-in methods
| Method | Guide |
|---|---|
| E-mail and password | Sign up and sign in |
| Magic link or one-time code by e-mail | Magic links and codes |
| OAuth (Google, GitHub, Apple, Microsoft and more) | OAuth providers |
| Anonymous users | Anonymous sign-ins |
| Phone number and SMS code | Phone sign-in |
| Crypto wallet (Solana, Ethereum) | Web3 wallets |
| Passkeys (Face ID, Touch ID, security keys) | Passkeys |
| Company identity provider (SAML 2.0) | Single sign-on (SAML) |
| Second factor (authenticator app or SMS) | Multi-factor authentication |
#Customize and protect
| Feature | Guide |
|---|---|
| Run your own code in the auth flow (custom claims, own e-mail/SMS sender, sign-up rules) | Auth hooks |
| CAPTCHA and leaked-password protection | Bot and abuse protection |
| Link several sign-in methods to one user | Identity linking |
| Let other apps sign in with your users (OAuth 2.1 / OpenID) | OAuth 2.1 server |
Configure everything per project in Studio → Authentication: Users, Sign-in methods, URL configuration, Emails, Hooks and Settings. Saving a setting restarts the project's Auth service, which is back within a few seconds.
#Endpoint
The Auth API of every project is at https://<project-ref>.p.stitchdb.com/auth/v1/. The SDK calls it for you.