Skip to main content
Start Free Trial

Authentication

Authentication settings apply across the tenant's hosted sign-in and account flows. Make changes in a non-production tenant first and keep an authenticated administrator session open until the new flow has been tested.

Availability

Login methods can be disabled, unavailable, or require additional configuration. Enterprise SSO and other advanced methods depend on your Guardhouse plan and deployment.

Before you begin​

  • Configure and test an email provider before relying on invitations, verification, password recovery, or magic links.
  • Use a stable HTTPS tenant domain before enrolling passkeys or registering social-provider callbacks.
  • Ensure at least two authorized administrators can recover access.
  • Decide whether new users may register or must be invited.

Configure login methods​

Open Authentication → Login methods to review the methods available to the tenant.

Email and password​

Use email and password when users maintain a Guardhouse password. Test sign-in, password creation, password change, and recovery before enabling it for production users.

Open Authentication → Passwordless to enable email magic links and set their expiration. Shorter validity reduces the useful life of a forwarded or intercepted link, but it must still allow for normal email delivery delays.

Magic links depend on a working email provider and active email templates.

Social login​

Open Authentication → Social logins to configure supported providers. The current dashboard supports:

  • Google
  • Facebook
  • Microsoft
  • Apple

Create credentials with the provider, copy the callback value presented by Guardhouse exactly, and enter the provider credentials in the dashboard. Test both a new social user and an existing user before rollout.

Providers shown as unsupported or unavailable are not usable merely because their name appears in the dashboard.

Passkeys​

Passkeys use WebAuthn and are bound to the relying-party identity derived from the tenant domain. Configure:

  • whether user verification is required, preferred, or discouraged;
  • resident-key behavior;
  • platform and cross-platform authenticators;
  • attestation behavior;
  • challenge timeout and registration attempts;
  • optional enrollment prompts and their frequency.

Passkeys require HTTPS outside local development. A domain change can change the relying-party identity and may require users to enroll new passkeys, so include passkey testing in every domain migration.

Configure the login flow​

Open Authentication → Login flow after enabling the underlying methods:

  1. Select the methods users may choose.
  2. Choose the primary email method when both password and magic link are available.
  3. Configure the verification policy.
  4. Save and test the complete flow in a private browser session.

Do not disable the last tested login method. A method that is enabled but missing provider or relying-party configuration is not a recovery path.

Configure signup​

Open Authentication → Signup flow and choose:

  • Invite-only when administrators or an approved workflow must create users.
  • Open when users may create their own account.

Configure invitation-link expiration. If email verification is enabled, also configure the verification-link expiration and test expired-link behavior.

Configure MFA​

Open Authentication → MFA to configure the implemented verification options:

  • TOTP authenticator apps;
  • backup recovery codes;
  • trusted devices and their expiration;
  • whether an authorized administrator may reset a user's MFA.

The login flow can make MFA optional or required. Before making it required, verify enrollment, recovery codes, trusted-device expiration, and the administrator reset procedure.

MFA reset

Resetting MFA removes a security factor. Confirm the user's identity through an approved recovery process, restrict the action to authorized administrators, and review the resulting activity.

Test before rollout​

Test at least these scenarios:

  • new signup or invitation;
  • existing-user login with every enabled primary method;
  • email verification and expired links;
  • password recovery and magic-link expiry;
  • MFA enrollment, challenge, recovery code, and reset;
  • passkeys on each supported device class;
  • social login success, denial, and callback mismatch;
  • logout and return to the correct application.

If a test fails, see Troubleshooting before changing unrelated settings.