Authentication
Everything you can do without a session lives under /auth/. These pages share the same centered card layout: the panel icon and name (or the configured banner) on top, a heading and subtitle, and the form. Below the form is an OR separator with alternate actions, shown on every page except the final choose a new password form.
If the panel's configured application URL doesn't match the address in your browser, a warning banner shows above the card on Login, Register, requesting a password reset, and the two-factor checkpoint. It doesn't show on the choose a new password form or the OAuth login page.
| Page | Description |
|---|---|
| Login | The two-step login flow, passkeys, OAuth providers, and the two-factor checkpoint |
| Register | Creating an account, when registration is enabled |
| Password Reset | Requesting a reset email and choosing a new password |
What Admins Control
What actually shows up on these pages depends on panel settings:
| Behavior | Where |
|---|---|
| Registration on or off | Enable Registration in Settings > Application |
| Who must use 2FA | Two-Factor Authentication Requirement in Settings > Application |
| Captcha on the auth forms | Settings > Captcha |
| Passkeys and usernameless login | Settings > Webauthn |
| OAuth login buttons | OAuth Providers |
| Reset and other outgoing email | Settings > Mail |
| Rate limits on the auth endpoints | Settings > Ratelimits; the OAuth callback has a fixed limit of 6 attempts per 5 minutes |