Authentication methods
The ways to prove who you are, which level each reaches, and how the methods used are recorded as the amr claim.
On this page
An authentication method is one way of proving who you are. A sign-in uses one or more. Which ones are open to you depends on what your account has set up and on what the organization you sign in to allows. How the sign-in page walks through them is on Signing in. This page explains what each one is.
The methods#
| Method | What you do | Level on its own |
|---|---|---|
| Passkey | Approve with your fingerprint, face, device PIN or a security key. | AAL2 |
| Password | Type a password. | AAL1 |
| Email link or code | Open the link in an email, or type its eight digit code, in the same browser you started in. Valid 15 minutes by default, once. Not accepted for an account that has a passkey and no authenticator app. | AAL1 |
| Linked account | Sign in through another provider, such as Google or GitHub, where the deployment offers one. | AAL1, or AAL2 if the provider reports a second factor |
| Authenticator app | Type the six digit code your app shows. Used as a second step after a password, when the sign-in looks unusual or an application or organization requires it. | Password plus app gives AAL2 |
| Recovery code | One of ten single-use codes you saved. A fallback for the authenticator app, offered at the second step where your organization allows it. | Used in place of the app code, after a password |
| Password only, in a limited session | After a password, on a sign-in that looks unusual and asks for more: Continue with my password only (limited session). See The second step. | AAL1, with the alert email, no remember-me and a Confirm it is you step before sensitive actions |
| Emailed code for a lost passkey | After your password, when a passkey is your only second step: Email me a code instead. See The second step. | AAL1: one level lower than a passkey |
No code is sent by text message or voice call. Those are not offered, because a phone number can be taken over.
For what each level means, see Assurance levels.
Passkeys#
A passkey replaces the password and the second step in one gesture. Nothing secret is sent to identity, and the passkey only works on the real site. See Passkeys.
Passwords#
A correct password always signs you in: on a browser the account knows it is enough, even on an account that has a passkey or an authenticator app, and on an unusual sign-in the platform restricts the session instead of turning you away. Every human account has a password: it is chosen at registration, at a Choose a password step for an account that has none, and at the end of recovery. A password must be at least 12 characters after normalization and at most 256. There are no rules about mixing character types. A new password is checked against known breaches when the check service is available. Identity stores only a salted, memory-hard hash of it. See Security practices for the details.
Email links and codes#
An emailed link does not sign you in by being opened. The page that opens says Opening this page does not sign you in. Only the button below does. This protects against software that follows links. A link works only in the browser that asked for it.
Linked accounts#
A linked provider proves who you are, and identity does not hold your provider password. Identity does not link a provider to an existing account just because the email address matches. You sign in with your existing method first, then link the provider from your account. The sign-in page says so: Sign in with your existing method first, then link that provider from your account.
Single sign-on through an organization#
An organization can own a sign-in connection (SAML or OpenID Connect) and claim an email domain. When you type an address on that domain, the sign-in page says Sign in with your organization, explains that the organization manages sign-in for your email address, and offers Continue with the organization or Use another method. The routing depends only on the domain you typed, so it is the same whether or not an account exists for the address. It works only while the tenant_connections flag is on, and the flag defaults OFF. An organization can go further and require single sign-on of its members. That enforcement works only while the sso_enforcement flag is on, and it defaults OFF. See Organizations.
Recovery codes#
A recovery code is an alternative to the authenticator app, not a method that stands alone. Where your organization allows it, the second step offers Use a recovery code. Using one consumes it. A recovery code is never enough to create new recovery codes or to remove the authenticator app: those need a live authenticator code or a passkey. See Step-up.
Extra steps#
Two optional extra steps exist, available where your organization allows them. A person turns each on for their own account.
- Password as a second step, after an emailed link or a linked-account sign-in.
- Email me a code as a second step, after a password.
Both add a check, and neither counts as two-factor verification. They stay at AAL1.
A third use of the emailed code is not an extra step you turn on: it is the lost-passkey fallback, offered by the platform to an account whose only second step is a passkey, only while the login_email_fallback flag is on (it defaults OFF). It stays at AAL1, always sends the new-sign-in alert, and notifies the account's other verified addresses. Applications that ask for two factors still ask for a passkey.
How the methods used are recorded: amr#
The methods a sign-in used are recorded on the session and copied into tokens as the amr claim, a list of short codes from the RFC 8176 vocabulary, with a few that identity defines because the standard has none.
| Code | Method | Shown in your account as |
|---|---|---|
pwd | Password | Password |
otp | Authenticator app code | Authenticator app |
hwk | Passkey | Passkey |
user | The device checked you. Always present with hwk. | Not shown on its own |
rcv | Recovery code | Recovery code |
ml | Emailed link or code | Email link |
eml | Emailed code used as a second step, including the lost-passkey fallback | Email code |
fed | Linked account | Linked account |
mfa | The provider reported a second factor | Provider second factor |
rec | A session created by account recovery | Account recovery |
A password plus an authenticator app is recorded as ["pwd", "otp"]. A passkey is recorded as ["hwk", "user"].
Treat amr as information, and acr as the decision. If an application needs a level of assurance, it should check acr, not assemble one from amr.
You see the methods behind each session in the Sign-in method column of the Sessions page. See Sessions and devices.
What an organization can allow#
An organization can limit which methods its members may use. Without a limit, every method is allowed. A limit is a list drawn from these.
- A passkey.
- A password with an authenticator app.
- A password alone.
- A linked account.
- An emailed link.
- A password followed by an emailed code.
- An emailed link followed by a password.
- A linked account followed by a password.
If a session was created with a method the organization does not allow, an application that sends someone to sign in to that organization causes the session to be asked to sign in again. A password with an authenticator app also satisfies a limit that allows a plain password. See Organizations.