1. Docs
  2. Authentication
  3. Configure sign-in, MFA, and self-signup

Configure sign-in, MFA, and self-signup

Turn sign-in methods on or off per Environment in the Developer Console, require MFA with a grace period, allow self-signup, and set the browser origins the API accepts.

Sign-in methods and browser origins

In the Developer Console, Tenant → Authentication is one page for every Environment's end-user authentication: a Sign-in methods (Direct API) section, an Identity MFA enforcement section, and a Self-signup section, each with one row per Environment.

Application
Developer Console
Path
TenantAuthentication
Opens with
  • auth_settings.view Read every Environment's sign-in methods, MFA enforcement, and self-signup settings.
Context
Account-wide. No Application or Environment selection applies.
Sign-in methods and browser origins
Open Authentication from the left nav under Tenant. In Sign-in methods (Direct API), each Environment's row shows its Login methods, Allowed origins, and Login CAPTCHA. Expand a row.Under Login methods, Password is on by default, Passwordless email code is off, and Single Sign-On reads Not configured until a connection is bound. Turning every method off shows the warning No usable sign-in method. Every login attempt on this environment will fail.; leave at least one on.Under Allowed web origins, add each origin your browser app calls from, as scheme and host only, such as https://app.example.com. With none, the API rejects every browser call for the Environment. Under SSO return URLs, add the exact URL your app returns to after an SSO sign-in; matching is exact.Turn Require CAPTCHA on login on only once your login page renders the Turnstile widget, or logins will be rejected. Reset discards an unsaved edit; save to apply.

Require MFA

MFA enforcement is per Environment. Existing sessions keep working; people are prompted to enrol at their next sign-in, and blocked once the grace period ends.

Require MFA
In Identity MFA enforcement, toggle Require MFA on an Environment's row. The confirmation, Require MFA for …?, spells out the effect. Confirm with Require MFA; the row changes from Optional to Required.Expand the row. Grace period (days) is how long people have to enrol before sign-in is blocked; 0 challenges on the next sign-in. Remember device (days) is how long a device skips the challenge; 0 challenges every sign-in.Under Allowed factors, choose between Authenticator app (TOTP), Email OTP, and WebAuthn / passkeys. At least one must remain allowed. Click Save changes.Toggling Require MFA off returns the row to Optional and disables its settings again.

Allow self-signup

Self-signup lets anyone holding the Environment's publishable key register from your app. Registrations create unverified identities that must confirm their email before signing in.

Allow self-signup
In Self-signup, toggle an Environment's row on. The confirmation, Enable for …?, states the effect; confirm with Enable signup. The row changes from Disabled to Enabled.Expand the row. Turn on Require CAPTCHA on sign-up once your signup page renders the Turnstile widget, and set a Daily signup cap per UTC day, where 0 means unlimited. Click Save changes; Discard changes drops an unsaved edit.
If you don't see this

Each control on this page exists only for someone who may use it. When something described above is missing, one of these is why:

Authentication is not in the left nav. Your administrator role does not carry auth_settings.view.The rows show but every toggle and field is disabled, with a notice explaining why. You hold auth_settings.view but not auth_settings.manage; the page is your read view of the settings.Single Sign-On reads Not configured. No SSO connection is bound to that Environment yet; bind one from Tenant → Single Sign-On.The MFA settings are disabled. MFA is not required on that row; the hint reads Enable MFA to configure.
How multi-factor authentication works → Direct API authentication →
Environment
API version
v1.0
 On this page Was this page helpful?

Tell us how we can improve this guide.

Canopy