Authentication
Sign-in methods, sessions, and how sign-in is secured.
Sign-in is Better Auth, mounted at /api/v1/auth.
Methods
- Email and password (at least 12 characters; passwords found in breaches are refused)
- Magic links, passkeys and two-factor authentication
- Google, GitHub, Microsoft and Apple: each turns on when its client id and secret are set
The sign-in page asks GET /api/v1/sign-in-methods which methods are enabled, so it shows only those.
Keycloak
Set KEYCLOAK_ISSUER, KEYCLOAK_CLIENT_ID and KEYCLOAK_CLIENT_SECRET to add Keycloak sign-in. With AUTH_MODE=keycloak, Keycloak becomes the only way in and local passwords are switched off. KEYCLOAK_ADMIN_ROLE names a realm role that makes someone a platform admin.
Single sign-on
Owners and admins connect their company's SAML 2.0 or OpenID Connect provider in Settings → Single sign-on. They prove they own the email domain with a DNS TXT record, _sso-verification-<provider>.<domain>, and members then sign in through it. MakeV1 checks every provider URL against private networks, and stores the client secret encrypted.
Sessions
The session is an HttpOnly cookie. No session token is ever sent to page scripts, and revoking a session, banning a user or removing a role takes effect on the next request.