Authentication Flows

Overview

Auth is a toll booth, not a destination: minimize fields, decisions, and round-trips, and never lose the user's work or intent across the auth boundary. Ask for identity (email) first and defer the credential decision — the server, not the user, should figure out what happens next.

When to Use

• Building signup, login, reset, verification, 2FA, or session-management screens
• Choosing among passwords, magic links, OTP codes, passkeys, OAuth/SSO
• Reviewing auth drop-off, lockout complaints, or duplicate-account bugs
• Handling session expiry, re-authentication, step-up auth, or logout UX
• NOT for: authorization/roles/permissions logic (backend access control)
• NOT for: machine-to-machine/API-key auth (no human in the loop)

The Proven Flow