Each Environment switches each method on or off on its own, so production can differ from development.
Email and password sign-in, checked against known breached passwords.
A six-digit code sent to the person's email, with no password to remember.
Sign in with a passkey alone, with browser autofill, bound to your own domain.
Sign-in buttons run on your own provider credentials, on the hosted pages or through the Direct API.
Using your own Google credentials.
Uses the person's primary verified email.
Personal and work accounts.
Your signing key is stored sealed.
Add any standards-compliant provider as a button.
Enrolment, challenges and recovery are all handled, on the hosted pages and through the Direct API.
Six-digit codes from any authenticator app.
Platform passkeys and hardware keys as a second step.
A code emailed when the person is challenged.
Single-use backup codes, issued with the first factor.
Skip the second factor on a remembered device for a set number of days. People can see and revoke theirs.
Set a policy for the Environment, and let each of your customers go further.
Require a second factor for everyone, or leave it to each organization.
An organization can require multi-factor authentication or narrow the ways in.
Removing a factor, changing an email or linking an account needs a fresh check.
Both run the same methods and the same rules, so the choice is about who renders the screen.
Built in, on the hosted pages and the Direct API.
Passwords found in known breaches are refused.
Repeated failed attempts lock the account.
Bot checks on sign-in and sign-up.