BUILD
Authentication lifecycle
The supported browser authentication lifecycle and its trust boundaries.
Enrollment
- Start enrollment with an email address.
- Verify the six-digit code through the enrollment token.
- Choose a password, a passkey, or both.
- Complete the selected server verification; only the password proof or verified public credential is persisted.
- Authenticate later with the chosen password or passkey to obtain a session.
Browser mutation requirements
- Exact production Origin validation.
- Double-submit CSRF proof where a browser session mutation is required.
- Secure, HttpOnly, host-only session cookies.
- Server-side challenge and attempt limits.