> For the complete documentation index, see [llms.txt](https://codemash.gitbook.io/codemash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codemash.gitbook.io/codemash/cloud/membership/settings/authentication.md).

# Authentication

Change how users sign in and out — logout addresses and passkey sign-in.

**Where:** Membership → Settings → **Authentication** · `/projects/<project>/membership/settings#authentication`

## Before you start

* For **+ Add logout environment**: an extra project environment — see [Environments](/codemash/cloud/project/settings/environments.md).
* For **Allow magic-link recovery**: the Email module is on.
* You need the `membership:manage` permission.

## Steps

1. Open **Settings → Authentication**. It has two blocks: **Auth preferences** and **Passkey**.

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-e9620e5a32228684c1fbac6c162d4efa1bfd3ecd%2Fsettings-authentication-1.png?alt=media" alt="Authentication tab: Auth preferences with Default logout URL and + Add logout environment; Passkey with Enabled and its rows"><figcaption><p>The Authentication tab.</p></figcaption></figure>
2. In **Auth preferences**, press **Change** next to **Default logout URL**, type the address users go to after they sign out, and press **Submit**. **+ Add logout environment** adds one address per project environment.

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-b00aed61ef3c42df5a699ee952d739eb61ca3f2e%2Fsettings-authentication-2.png?alt=media" alt="Dialog Default logout URL with https://app.example.com/signed-out, Cancel and Submit"><figcaption><p>The <strong>Default logout URL</strong> dialog.</p></figcaption></figure>
3. In **Passkey**, the **Enabled** switch turns passkey sign-in (Face ID, Touch ID, Windows Hello, a security key) on; new managed-service projects have it on. Press **Change** next to a row to set it:

   | Setting                            | What it does                                                                                                                        | Example                   |
   | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
   | Email code lifetime (minutes)      | How long an emailed sign-up code works.                                                                                             | `10`                      |
   | Max passkeys per user              | How many passkeys one user may register.                                                                                            | `5`                       |
   | Recovery codes per user            | How many one-time recovery codes a user gets.                                                                                       | `10`                      |
   | Generate recovery codes at sign-up | Gives the codes at sign-up.                                                                                                         | On                        |
   | Accepted authenticators            | Which devices count as a passkey.                                                                                                   | Any authenticator         |
   | Allow magic-link recovery          | Lets users get back in with an emailed link (needs Email).                                                                          | Off                       |
   | Refresh token lifetime (days)      | How long a sign-in can be renewed.                                                                                                  | `60`                      |
   | Relying Party ID (advanced)        | The domain passkeys are bound to; empty = taken from your CORS origins. Changing it after going live breaks every existing passkey. | Derived from CORS origins |

   **Always on for security** lists what cannot be changed: 6-digit codes, a lock after 5 wrong codes, biometric or PIN always required, discoverable credentials always required.

## Result

A passkey change saves at once; after a reload **Max passkeys per user** shows `5`.

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-ac66969b54a4cf849dd1839f4ef292e310ce550b%2Fsettings-authentication-3.png?alt=media" alt="Passkey block after a reload: Max passkeys per user 5"><figcaption><p>The Passkey block after a reload.</p></figcaption></figure>

{% hint style="warning" %}
The **Default logout URL** is not kept today: after **Submit** and a reload it shows `-`, and the API returns `logoutUrl: ""`.
{% endhint %}

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-ac66969b54a4cf849dd1839f4ef292e310ce550b%2Fsettings-authentication-3.png?alt=media" alt="Auth preferences after a reload: Default logout URL shows a dash"><figcaption><p>The logout address after a reload.</p></figcaption></figure>

## Change or remove it later

* **Change** a row again; the **Enabled** switch turns passkey sign-in off without losing the values.
* Passkey users sign up through your app — see [Add a user](/codemash/cloud/membership/users/new.md) (**Passkey** card).

## Do it from code

```ts
const { result } = await norbix.hub.membership.getAuthenticationSettings();
console.log(result.credentialsSettings.allowUsernames, result.flows);
const passkey = await norbix.hub.membership.getPasskeySettings();
console.log(passkey.result.enabled, passkey.result.maxCredentialsPerUser); // true 5
```

```sh
norbix hub membership passkey settings get
```

Save with `savePasskeySettings` (every field: `enabled`, `codeTtlMinutes`, `maxCredentialsPerUser`, `recoveryCodeCount`, `generateRecoveryCodesAtSignup`, `authenticatorAttachment`, `allowMagicLinkRecovery`, `refreshTokenTtlDays`, `rpId`). The client setup is on the [Membership page](/codemash/cloud/membership.md#use-it-from-code). API: [Get Authentication Settings](/codemash/api-reference/membership/settings/get-authentication-settings.md) · [Get Passkey Settings](/codemash/api-reference/membership/settings/get-passkey-settings.md) · [Save Passkey Settings](/codemash/api-reference/membership/settings/save-passkey-settings.md) · [Passkeys & Recovery](/codemash/api-reference/membership/passkeys-recovery.md)