# Authentication

Everything you can do without a session lives under `/auth/`. These pages share the same centered card layout: the panel icon and name (or the configured banner) on top, a heading and subtitle, and the form. Below the form is an **OR** separator with alternate actions, shown on every page except the final [choose a new password](/docs/panel/features/auth/password-reset#choosing-a-new-password) form.

If the panel's configured application URL doesn't match the address in your browser, a warning banner shows above the card on [Login](/docs/panel/features/auth/login), [Register](/docs/panel/features/auth/register), [requesting a password reset](/docs/panel/features/auth/password-reset#requesting-a-reset), and the [two-factor checkpoint](/docs/panel/features/auth/login#two-factor-checkpoint). It doesn't show on the [choose a new password](/docs/panel/features/auth/password-reset#choosing-a-new-password) form or the [OAuth login](/docs/panel/features/auth/login#oauth-login) page.

| Page | Description |
| --- | --- |
| [Login](/docs/panel/features/auth/login) | The two-step login flow, passkeys, OAuth providers, and the two-factor checkpoint |
| [Register](/docs/panel/features/auth/register) | Creating an account, when registration is enabled |
| [Password Reset](/docs/panel/features/auth/password-reset) | Requesting a reset email and choosing a new password |

## What Admins Control

What actually shows up on these pages depends on panel settings:

| Behavior | Where |
| --- | --- |
| Registration on or off | **Enable Registration** in [Settings > Application](/docs/panel/features/admin/settings#application) |
| Who must use 2FA | **Two-Factor Authentication Requirement** in [Settings > Application](/docs/panel/features/admin/settings#application) |
| Which factors count towards that requirement | **Accepted Two-Factor Methods** in [Settings > Application](/docs/panel/features/admin/settings#application) |
| Codes by email as a second factor | **Email Two-Factor** in [Settings > Application](/docs/panel/features/admin/settings#application) |
| Whether new accounts must verify their email | **Require Email Verification** in [Settings > Application](/docs/panel/features/admin/settings#application) |
| Captcha on the auth forms | [Settings > Captcha](/docs/panel/features/admin/settings#captcha) |
| Passkeys and usernameless login | [Settings > Webauthn](/docs/panel/features/admin/settings#webauthn) |
| OAuth login buttons | [OAuth Providers](/docs/panel/features/admin/oauth-providers) |
| Reset and other outgoing email | [Settings > Mail](/docs/panel/features/admin/settings#mail) |
| Rate limits on the auth endpoints | [Settings > Ratelimits](/docs/panel/features/admin/settings#ratelimits); the OAuth callback has a fixed limit of 6 attempts per 5 minutes |